4 ms·
If the request never has to leave the process, that means there isn't anything the third party API is doing that persists state or calls out to another backend.
by hueving 8y ago
If the request never has to leave the process, that means there isn't anything the third party API is doing that persists state or calls out to another backend. In that case, wouldn't it just be better to import this third party API directly as code and call it for significantly better reliability, performance, and reduced complexity?
- woah 8y agoThen your engineers are responsible for maintaining and updating it. Calling to a third party allows you to offload that.
- zackbloom 8y agoThere are advantages in being able to have a security barrier between your code and that of your customers, and that you can push releases etc without having to update every downstream consumer. More importantly though, we're working on incorporating storage in a meaningful way.
- jayd16 8y agoIf the third party code is running in the same process than the security is managed by V8 (or whatever runtime). Does such a thing exist in other managed languages? Does anyone know if C# or Java(for example) have the concept of untrusted libraries?
- regularfry 8y agoDunno about managed runtimes, but the whole thing sounds isomorphic to running a bunch of untrusted docker containers in a single qemu VM.
- heavenlyblue 8y agoYou could think of "untrusted library" as of a wrapper around an HTTP API. The code you don't run, but depend upon it's results.