Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Extism makes WebAssembly easy

dylibso.com

Post reply on HN
Print view View original

81–90 of 100 posts

Re: Extism makes WebAssembly easy

#81

Post by c7DJTLrn »

simonw wrote: post #23

The thing I want to achieve with WebAssembly is still proving a lot harder than I had anticipated. I want to be able to take strings of untrusted code provided by users and execute them in a safe sandbox. I have all sorts of things I want this for - think custom templates for a web application, custom workflow automation scripts (Zapier-style), running transformations against JSON data. When you're dealing with untru…

As another reply says, there's no such thing as perfect sandboxing unfortunately, especially not with the string of CPU side channels that have been uncovered, and continue to be revealed.

Re: Extism makes WebAssembly easy

#82

Post by xmonkee »

ramesh31 wrote: post #67
brabel wrote: post #27

Earlier quoted context omitted.

Exactly. That's what Extism is trying to solve. That WASI post doesn't show at all how to use the WASM code from C, or vice versa, because it just compiles the entire C program to WASM which uses the POSIX-based WASI API. If you want an alternative to Extism, you need something like wasmer.io, not just wasmtime (Extism actually uses wasmtime as mentioned in the post).

Right. The point being that you can take your pick of WASI compliant runtimes which have those features. Extism isn't something special compared to any other open source project in this domain, yet it smells of a commercial venture. Count me out.

>Extism isn't something special compared to any other open source project in this domain

Well, ok, can you give me an example of some other project doing this sort of interop without manual memory mapping?

Re: Extism makes WebAssembly easy

#83

Post by laurencerowe »

simonw wrote: post #79
Veserv wrote: post #76

Earlier quoted context omitted.

Browser sandbox escapes from untrusted JavaScript are discovered and exploited regularly. JavaScript is much more constrained than the full force of a low level language like WebAssembly, and they can not even get the JavaScript sandbox safe to run truly untrusted or malicious code. Why would something harder to do work when they can not even do the easier thing? Unless you are just talking about something meant to h…

I know that it's hard, but I'm not ready to agree that this isn't worth seeking answers to. AWS run untrusted code on Lambda all the time. Browsers seem to be handling this pretty well in the face of the most untrustworthy computing environment our species has yet developed. Zero days in browsers are big news, and don't happen very often.

> AWS run untrusted code on Lambda all the time.

AWS uses virtualization (Firecracker) to provide isolation for Lambda.

WebAssembly vs browser/javascript isolation is a little like virtualization vs operating system level isolation. WebAssembly and virtualization offer far smaller attack surfaces which mean they are far more likely to remain secure in the long term.

Browsers and operating systems are highly complex abstractions and they only remain secure (if you keep them patched) through the large ongoing investment in them.

Re: Extism makes WebAssembly easy

#84

Post by Veserv »

simonw wrote: post #79
Veserv wrote: post #76

Earlier quoted context omitted.

Browser sandbox escapes from untrusted JavaScript are discovered and exploited regularly. JavaScript is much more constrained than the full force of a low level language like WebAssembly, and they can not even get the JavaScript sandbox safe to run truly untrusted or malicious code. Why would something harder to do work when they can not even do the easier thing? Unless you are just talking about something meant to h…

I know that it's hard, but I'm not ready to agree that this isn't worth seeking answers to. AWS run untrusted code on Lambda all the time. Browsers seem to be handling this pretty well in the face of the most untrustworthy computing environment our species has yet developed. Zero days in browsers are big news, and don't happen very often.

If you can sandbox arbitrary malicious code, then you can make a unhackable operating system/runtime. Such a feat is frequently viewed as literally impossible in many software circles and would constitute a extraordinary claim that demands impeccable, extraordinary evidence to support it such as, minimally, mathematical proofs of the entire code base. Nothing less should overcome the sheer ideological inertia behind the common-sense view that everything is easily hacked as has been continuously demonstrated on basically everybody all the time.

So, unless you want to claim Amazon has invented a unhackable operating system to run AWS, has the mathematical proofs of correctness to support such a extraordinary claim, and has just not bothered to tell anyone, claiming AWS can actually securely run untrusted code is pure unsupported bluster. In fact, I bet exactly zero people at Amazon would back up such a claim if pressed, and if even the people doing it think it is impossible then there is no way they are actually doing it. The same goes for browsers.

As to zero days in browsers being big news, they are really not. Zerodium only pays 500 K$ for a Chrome RCE+LPE [1]. That is pocket change. Ransomware attacks ask for millions of dollars per attack these days. They can literally afford to burn multiple Chrome RCEs per attack (if needed) and still come out profitable. The cost of sandbox escape needs to be somewhere around 20-100x higher for it to be viewed as "secure" against the common threats seen every day.

[1] https://zerodium.com/program.html

Re: Extism makes WebAssembly easy

#85

Post by jcrites »

simonw wrote: post #23

The thing I want to achieve with WebAssembly is still proving a lot harder than I had anticipated. I want to be able to take strings of untrusted code provided by users and execute them in a safe sandbox. I have all sorts of things I want this for - think custom templates for a web application, custom workflow automation scripts (Zapier-style), running transformations against JSON data. When you're dealing with untru…

As a robust sandbox, have you considered using a micro-VM? Firecracker [1] comes to mind, the VM behind AWS Lambda. It's designed to be lightweight to launch, suitable for running ephemeral code.

While I agree that it'd be nice to be able to use WASM for this purpose, it seems like a microVM might provide a more convenient interface: you can "just" run any existing programming language inside it (without needing any specific support for e.g. WASM). Indeed, you could run multiple processes built with different programming languages together and allow them to communicate in standard ways.

Additionally, VMs offer a number of advantage from a security perspective. Hypervisor VMs take advantage of hardware support, and their surface area is arguably well-hardened and smaller than alternatives (hence why VMs are used for cloud computing).

> I've not found a good pattern for running a JavaScript interpreter in a WASM sandbox yet

Is there a good reason to do this? I thought WASM typically used the V8 JavaScript interpreter as its sandbox and to execute code. If you could launch WASM, couldn't you equivalently launch an instance of V8 with the JavaScript code running inside directly? I do think this is a good question, and it raises further questions like: what if I want to run JavaScript and WASM side-by-side, so that they can communicate with each other and/or with native code.

[1] https://firecracker-microvm.github.io/

Re: Extism makes WebAssembly easy

#86

Post by bhelx »

yebyen wrote: post #34
bhelx wrote: post #19

Earlier quoted context omitted.

This is great so far btw! Going to watch this whole talk today.

There's a lightning talk version from GitOpsCon (at GitOpsCon/CDCon Vancouver - co hosted with OSS Summit later in the week) But they are pretty much the same talk, except at CDCon, I hadn't written the Kubernetes operator so that it actually ran the Wasm module yet. At the end of the talk at OSS Summit, I show it running and I'm so glad you enjoy it! I will definitely check out your new ruby SDK :tada:

Come join our Discord if you get the chance and find me there in the ruby-sdk channel. I've been doing some experiments with Wasm and ruby (particularly around rails and higher level application abstractions) and would love to have another rubyist to bounce ideas off of. Also I had trouble tracking down your email, but if you'd prefer you can reach me at ben at dylibso dot com

Re: Extism makes WebAssembly easy

#87

Post by bhelx »

yebyen wrote: post #34
bhelx wrote: post #19

Earlier quoted context omitted.

This is great so far btw! Going to watch this whole talk today.

There's a lightning talk version from GitOpsCon (at GitOpsCon/CDCon Vancouver - co hosted with OSS Summit later in the week) But they are pretty much the same talk, except at CDCon, I hadn't written the Kubernetes operator so that it actually ran the Wasm module yet. At the end of the talk at OSS Summit, I show it running and I'm so glad you enjoy it! I will definitely check out your new ruby SDK :tada:

really enjoyed the talk btw!

Re: Extism makes WebAssembly easy

#88

Post by nilslice »

esafak wrote: post #80
justinclift wrote: post #56

Earlier quoted context omitted.

Not really a real-time chat replacement thing, so it's not a suitable replacement.

That's a feature. Promote discussions, not chit chat.

we also like Discord _for_ the “chit chat” though. getting to know the community that’s growing around your project is one of the most enjoyable aspects of open source IMO!

Re: Extism makes WebAssembly easy

#89

Post by wikiwong »

jcrites wrote: post #85
simonw wrote: post #23

The thing I want to achieve with WebAssembly is still proving a lot harder than I had anticipated. I want to be able to take strings of untrusted code provided by users and execute them in a safe sandbox. I have all sorts of things I want this for - think custom templates for a web application, custom workflow automation scripts (Zapier-style), running transformations against JSON data. When you're dealing with untru…

As a robust sandbox, have you considered using a micro-VM? Firecracker [1] comes to mind, the VM behind AWS Lambda. It's designed to be lightweight to launch, suitable for running ephemeral code. While I agree that it'd be nice to be able to use WASM for this purpose, it seems like a microVM might provide a more convenient interface: you can "just" run any existing programming language inside it (without needing any…

Firecracker is a fine technology, but serverless companies have started taking advantage Wasm's faster start-up and invocation times for use cases of running Wasm on the server (https://www.youtube.com/watch?v=yqgCxhPAao0). The deny by default security policy makes Wasm a popular choice to run code in isolation, particularly for maximizing hardware resources in the multi-tenant environments these serverless companies operate.

> Is there a good reason to do this?

One use case to run JS inside a Wasm VM is Shopify Functions. Shopify allows their customers to customize things like checkout flow by writing code compiled to Wasm which gets executed during the checkout process. They want their customers to be able to write JS as well as other languages. https://github.com/Shopify/function-runner

> I thought WASM typically used the V8 JavaScript interpreter as its sandbox and to execute code.

V8 is popular for running Wasm on the web and for some serverless companies, but there are a bunch of serverless, blockchain, and iot projects that use other Wasm runtimes (Wasmtime, WAMR, WasmEdge, and Wasmer to name a few) - https://github.com/appcypher/awesome-wasm-runtimes

Re: Extism makes WebAssembly easy

#90

Post by spankalee »

Veserv wrote: post #72
simonw wrote: post #23

The thing I want to achieve with WebAssembly is still proving a lot harder than I had anticipated. I want to be able to take strings of untrusted code provided by users and execute them in a safe sandbox. I have all sorts of things I want this for - think custom templates for a web application, custom workflow automation scripts (Zapier-style), running transformations against JSON data. When you're dealing with untru…

The problem you want solved, perfect sandboxing for untrusted code, is only just THE single most important problem in operating system security. If you can solve that then you have the basis of a perfectly secure, unhackable operating system. Anybody claiming to solve that problem at speed in any other software domain can trivially use those same techniques to create a perfectly secure operating system runtime. So, y…

Fuchsia solves that.
Post reply on HN