3 ms·

> 2. The scalability of edge computing requires finer-grained isolation than process isolation. Why? Browsers are moving to one process per security domain any

> 2. The scalability of edge computing requires finer-grained isolation than process isolation. Why? Browsers are moving to one process per security domain anyway. Workers spawn their own threads too. You have to make your processes more lightweight and optimize memory-sharing, but that's exactly what's happening. There's also some vodoo one might be able to do on linux with the clone syscall which lets you spawn a new process which still shares the same memory as the parent.

kentonv 8y ago
> Browsers are moving to one process per security domain anyway. At a significant cost in RAM usage and some CPU overhead too. But browsers have the advantage that they are sitting on desktops and laptops that are massively underutilized, and the number of security domains you might typically have open at once is in the 10's or 100's, not 10,000's. But that's not what I was talking about with "edge computing". I'm the architect of Cloudflare Workers, an edge compute platform. We have 151 locations today and are pushing towards thousands in the coming years, and every one of our customers wants their code to run in every location. As we push to more and more locations, the available resources in each location decrease, but the number of customers will only increase. At our scale, unlike browsers, one-process-per-customer just isn't going to scale. Context switching is too expensive, RAM usage per process is too high, etc. So we need other ways to mitigate attacks. > There's also some vodoo one might be able to do on linux with the clone syscall which lets you spawn a new process which still shares the same memory as the parent. It's not really voodoo. Linux has no distinction between processes and threads. Everything is a process. But two processes can share the same memory space. Usually, developers call these "threads", and use "process" to mean "the set of threads sharing a memory space". In any case, if it's the same memory space, then it's susceptible to Spectre attacks.
pcwalton 8y ago
There are limits to Site Isolation. For example, due to document.domain, subdomains of a domain cannot generally be protected from one another. kentonv is correct that giving up on intra-process security entirely is an ominous sign.
- gpderetta 8y ago
  What we need is the equivalent of inter process isolation for intraprocess sandboxes, i.e. an hardware solution (hopefully this time not affected by Meltdown). And we might already have it. Thanks to virtualization hardware, it should be possible for a process to own and handle its own private page table mapping completely from userspace [1]. Switching from the sandboxed code to the sandboxing code might be more expensive than a plain function call, but still way faster than IPC. [1] For example, libDune (https://github.com/ramonza/dune https://github.com/ramonza/dune), which admittedly seems a dead project. Also it requires OS support.

kentonv 8y ago

> Browsers are moving to one process per security domain anyway. At a significant cost in RAM usage and some CPU overhead too. But browsers have the advantage that they are sitting on desktops and laptops that are massively underutilized, and the number of security domains you might typically have open at once is in the 10's or 100's, not 10,000's. But that's not what I was talking about with "edge computing". I'm the architect of Cloudflare Workers, an edge compute platform. We have 151 locations today and are pushing towards thousands in the coming years, and every one of our customers wants their code to run in every location. As we push to more and more locations, the available resources in each location decrease, but the number of customers will only increase. At our scale, unlike browsers, one-process-per-customer just isn't going to scale. Context switching is too expensive, RAM usage per process is too high, etc. So we need other ways to mitigate attacks. > There's also some vodoo one might be able to do on linux with the clone syscall which lets you spawn a new process which still shares the same memory as the parent. It's not really voodoo. Linux has no distinction between processes and threads. Everything is a process. But two processes can share the same memory space. Usually, developers call these "threads", and use "process" to mean "the set of threads sharing a memory space". In any case, if it's the same memory space, then it's susceptible to Spectre attacks.

pcwalton 8y ago

There are limits to Site Isolation. For example, due to document.domain, subdomains of a domain cannot generally be protected from one another. kentonv is correct that giving up on intra-process security entirely is an ominous sign.

gpderetta 8y ago
What we need is the equivalent of inter process isolation for intraprocess sandboxes, i.e. an hardware solution (hopefully this time not affected by Meltdown). And we might already have it. Thanks to virtualization hardware, it should be possible for a process to own and handle its own private page table mapping completely from userspace [1]. Switching from the sandboxed code to the sandboxing code might be more expensive than a plain function call, but still way faster than IPC. [1] For example, libDune (https://github.com/ramonza/dune https://github.com/ramonza/dune), which admittedly seems a dead project. Also it requires OS support.