|
Top-level
 @anildash I don't think enough people have realized how incredibly valuable the robust universal sandboxing provided by WASM is going to be I genuinely don't want to run code written by other people that's NOT in a sandbox at this point: even if I trust them, do I also trust them not to have written any bugs? WASM to me represents the freedom to run code on my machines again! 27 comments
@anildash @simon it's one of those things that's not completely original, given that sandboxing and portable bytecode have existed in various guises for me years, so that people are going to bash it as hype-driven or valueless. But it's the combination of features, standardization, and broad adoption that's going to be its selling point  @stephenjudkins @simon yeah, all of this stuff is the kind of wonderful tech that sort of slowly gestates for a half decade or so, being dismissed as too early, or too familiar, or not “enterprise” enough or whatever. And then suddenly it’s everywhere. @stephenjudkins @anildash @simon I started using WASM for something at work recently and it's freaking wild. I am so ready @stephenjudkins @anildash @simon this was the refrain about docker too, particularly from the BSD community. But it nailed those three aspects and so adoption skyrocketed whether the haters thought it worthwhile or not. I’m really just becoming aware of wasm, particularly outside the browser, but it certainly feels like it’s got the same energy/momentum. @mgaruccio @anildash @simon yes. It was the standard that made it important, not the constituent technologies, which had been in Linux for quite awhile. I'm actually pretty annoyed that docker/OCI was the standard that took off, I think it could have been done a lot differently and better @stephenjudkins @anildash @simon yea it’s frankly a little weird that underneath all the declarative and immutable tooling that got built on top we have this imperative image build process that gets captured in a tarball with networking and storage defined at runtime. But, that also made it easy to start using, and flexible for many use-cases. Which really drove the adoption piece of the puzzle (and nature of FOSS meant features followed that adoption) I must admit I don't quite understand what WASM sandbox does right but JVM did not. It wasn't JUST the Java API was too insanely large, but there were plenty of JVM exploits as well. Is there a guide someplace why WASM hasn't repeated the fate of the JVM? @ncweaver @anildash I don't have a great solid answer for that, but the impression I've got is that WASM was helped by twenty years of lessons from the JVM and from browser development in general Browser developers are really, really good at understanding the challenges involved in executing code from untrusted sources! I think that may be it. The JavaScript JITs are insane, and that they aren't subject to more OMG breakages, and the browsers these days split the rendering engine per origin into a separate process (with all the process isolation on top), the browser folks have a lot of experience. Also, I think WASM started much smaller, and the only outside world is through the JavaScript framework rather than direct probably helps too.  One weakness in Java was JNI because at some point you have to get data in/out of real devices. If my webcam is some janky Costco $6 special, with a buggy, vulnerable terrible driver, does WASM protect me from malicious web pages that want to tickle my vulnerable webcam driver? Or is it just orthogonal? I.e. not WASM’s circus, so not WASM’s monkeys? I think they handle that by basically EVERY bit of I/O has to go through the JavaScript, so it isn't adding to that problem space.  I've been playing with safe WASM plugins for resource edition in @capyloon and one super-power is that the "host" code can check which functions are imported by plugins. That makes it possible to enforce eg. privacy policies or permission models.   It's definitely going to take a minute to be realized, but it affords a wealth of capabilities. @simon @anildash which is all well and good until it ask for permission to access your location, camera and wallet to work. So now you are allowing random websites access to your device with no barrier or checks. One advantage of app stores or distributions is that there can be some management of the bad apps. Now your device can run software from anywhere you are relying on the discretion of a user as the only security check.  @simon @anildash Is there a good high-level discussion somewhere that compares the security models of WASM, JAVA, .NET, and Linux containers (plus perhaps others)? Addressing questions such as granularity (per file/directory/other, IP by IP address/domain/other), roles (user, administrator, developer, ...), complexity (yes/no settings, conditions, Turing-complete configuration language), etc. |
Gregory's Server
@simon and the other extraordinary thing is it enables the consistency and reliability of environments that’s one of the biggest advantages of the native mobile platforms (or even gaming consoles) without the negatives of the App Store model. There’s just so much potential there.