4 ms·

How well do they support software sandboxing?

• pjmlp 8y ago
  Not sure if I get your point. The mainframe ones, are just like any other OS, code gets generated at installation time, then they are OS processes just like any other. Java and MSIL depend on how they get used. Both have bytecode verifiers, and multiple ways to deploy. Either as single runtime, where strong typing plays the role of sandboxing, or as multiple processes/containers. Just to use .NET as example, not going to make an exhaustive list. .NET Micro Framework deployed on Netduino, the runtime is the OS, only strong typing takes place. .NET Framework on Windows, and .NET Core on Windows/Mac/Linux, each CLR instance gets their own OS process, which might be additionally wrapped into an OS container. .NET Core on UWP, applications run as separate sandboxed process using the UWP sandbox model. Xamarin on iOS runs with the iOS sandbox model, after AOT compiling for deployment. Xamarin on Android, runs with the Android sandbox model where binary code gets dynamically loaded into ART instance, sandboxed via SELinux and Linux container mechanisms. And regarding security, Web Assembly still fails short of preventing memory corruption inside of the loaded module. I was hoping pointers would be tagged, but that doesn't seem to be part of the design goals.