22 ms·

The Bytecode Alliance: Building a secure, composable future for WebAssembly

407 points by markdog12 7y ago

JoshTriplett 7y ago
I'm one of the folks working with the Alliance, and I'm incredibly excited about WebAssembly outside the browser. Happy to answer questions. Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data. Imagine supporting a safe plugin API that isn't just for C and languages that FFI to C, but works natively with safe datatypes. Today, if you want to be extensible, you typically expose a C API for people to link to, or you embed a specific language like Lua or Python. Imagine embedding a WebAssembly runtime like wasmtime, and telling people they can write their extensions in any language they want.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- Jyaif 7y ago
  Will this work on platforms that do not allow JIT compilation?
  - JoshTriplett 7y ago
    Lucet supports ahead-of-time compilation, and WAMR provides an interpreter.
    - tschneidereit 7y ago
      And Wasmtime will also support both of those. Support for environments in which JITting is not an option is of course really important to this!
- ctz 7y ago
  The post mentions: > tiny IoT device But, I've looked at this in the past and concluded wasm was a pretty poor fit for small devices: 1) it only addresses memory in 64KB pages (perhaps more SRAM than you might have) and 2) requires both single and double float support. (1) might be possible to work-around by backing the memory space with smaller page allocations -- at the cost of indirection for every memory access. (2) seems pretty insurmountable -- it'll just need a chunk of extra C library. Are you aware of any projects working on this for smallish microcontrollers?
  - JoshTriplett 7y ago
    You don't have to support floats; you can, for instance, support loading and validating WebAssembly modules only if they don't use any floating-point operations.
    - wahern 7y ago
      Much like C, which also requires floating point support. WebAssembly implementations for tiny IoT environments can emulate floating point in reliance on people not using it heavily, just as you'd expect them not to run Node.js. But at least the developer has the option, which can have significant value, such as during exploration and experimentation phases. Similarly, compilers like GCC will synthesize 64-bit arithmetic inline for i386 and other targets lacking 64-bit support. These days few people think twice about using 64-bit data types even though 32-bit processors are still in heavy use. (Though, AFAIU emulation has largely moved from compiler to the instruction decoder or microcode.)
  - afiori 7y ago
    > it only addresses memory in 64KB pages is this by the standard or implementations?
- al2o3cr 7y ago
  no ability to exfiltrate data As we've learned with things like rowhammer and Spectre, this is a very high bar. How does this initiative plan to deal with side-channel attacks?
  - sunfish 7y ago
    This is discussed in the blog post; see the discussion of "time protection".
    - robocat 7y ago
      If you're just reading hn comments: "There is unfortunately one less straightforward way that attackers can access another module’s memory—side-channel attacks like Spectre. OS processes attempt to provide something called time protection, and this helps protect against these attacks. Unfortunately, CPUs and OSes don’t offer finer-than-process granularity time protection features." "[snip] Making a shift to nanoprocesses here would take careful analysis." "But there are lots of situations where timing protection isn’t needed, or where people aren’t using processes at all right now. These are good candidates for nanoprocesses." "Plus, as CPUs evolve to provide cheaper time protection features, WebAssembly nanoprocesses will be in a good position to quickly take advantage of these features, at which point you won’t need to use OS processes for this."
- uwydr 7y ago
  For the Horde!
- jkoberg 7y ago
  So, like, Java?
  - JoshTriplett 7y ago
    https://news.ycombinator.com/item?id=21516212 https://news.ycombinator.com/item?id=21516212
  - weberc2 7y ago
    > Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data How does Java preclude plugins exfiltrating data? Downvoters: I’m not trying to be sacrilegious; I genuinely don’t know the answer.
    - chii 7y ago
      You can use a security manager and define permission on what the loaded java code can do. Unfortunately, it's fraught with danger because of the confused lieutenant issue ( you'd need to give parts of the app permission but not others - doing so isn't trivial).
      - scolby33 7y ago
        Just to help others searching for "confused lieutenant," I believe it's usually known as the "confused deputy problem," perhaps as a reference to Barney Fife. I do like the image of a confused lieutenant though.
- mrbonner 7y ago
  I am very interested in the inter "process" comm (or, inter "module" comm to be precised). From the surface, this runtime and modular system look pretty similar to the based OSGi runtime plus OSGi security. Not that I wanted to scare folks here as OSGi has a bad reputation of being bloated :-)
- weberc2 7y ago
  I'm particularly interested in a world where wasm binaries replace (or supplement) containers (or even VMs?). I'm specifically imagining Kubernetes or AWS Lambda but with direct wasm execution (instead of wasm-in-container or wasm-in-VM). I'd be curious if anyone has put more thought into this and what possibilities they envision.
- Narishma 7y ago
  > Imagine embedding a WebAssembly runtime like wasmtime, and telling people they can write their extensions in any language they want. Is that desirable? Won't it lead to a bloated mess with every extension dragging in a different language runtime with it?
  - kaetemi 7y ago
    Web developers don't seem to have any concern about using gigantic quantities of memory. Don't hire a web developer to develop for games. :)
    - StavrosK 7y ago
      It's almost as if spending time optimizing memory usage isn't worth it because server RAM is cheap!
      - bpt3 7y ago
        What does server RAM have to do with modern web development, where the vast majority of the work is done on the frontend?
  - nine_k 7y ago
    With several programs using wasm, the runtimes can be shared, the way shared libraries work in modern OSes, or shared assemblies .net.
  - 6nf 7y ago
    Yea but sometimes we are willing to run an entire nano linux in a WASM module if it helps launch a few days earlier!
- simonebrunozzi 7y ago
  > and I'm incredibly excited about WebAssembly outside the browser. What's your take on the browser, instead? Curious to hear your point of view. p.s. Thanks for working with the Alliance, I think it's great news overall.
- devwastaken 7y ago
  This isn't entirely accurate. Exploitations in whatever code is converted to wasm instructions still work inside the wasm memory space. As in, if you write your program in c, python, whatever, and put it in wasm, then have a wasm extension system of some sort - if that c or python is exploitable, then whatever external access that wasm instance has is now useable. And whatever memory is in the memory space can be modified. This is an important distinction. Wasm should be thought of as a tool to containerise execution and memory if the implimentation is proven to do so.
  - vanderZwan 7y ago
    Does WASM let you run memory as code?
    - thekingofh 7y ago
      No. Marking memory as executable is a native machine level capability (as in x86_64 assembly machine instructions). Wasm is a stack machine interpreter that can read only Wasm binaries. The binary format is essentially just a compressed/minimized form of the bytecode format, which used to essentially be an AST of the original source code, but now I believe they modified it a bit to be more analogous to hypothetical machine code, but still abstracted. The Wasm interpreter does not understand x86 or ARM or whatever machine code it's fed it and rightly so. If that was possible, anyone could just send over a buffer to the browser to execute whatever they want.
      - vanderZwan 7y ago
        That's what I thought. Then that's one whole category of exploits that no longer applies, no?
        thekingofh 7y ago
        Yes, assuming there's no flaws in the interpreter. But they're all moving full steam ahead in the browsers right now, so imagine it's deemed as safe as javascript. The current push is to divvy up the permissions of certain resources such as sockets and filesystem (browser code don't have filesystem access) and make an API to ensure that modules don't overstep their granted permissions. It'll probably look a lot like node and npm, where you could add a module to your source and know that it can't access things it shouldn't. Pretty exciting stuff. It's a true merger of all languages together under one runtime.
- thekingofh 7y ago
  Is there a plan to bring together a bunch of these extensions under one roof with a package/dependency manager similar to cargo or npm, or is it intended to be glued together on the developer side? To me this looks massive, like to be able to pull down modules knowing what permissions they need, and to be able to have some kind of assurances that the code can't misbehave.
- hz10 7y ago
  Fantastic! Since I made quite a few Silverlight RIAs, WASM is like Silverlgitht on steroids. I am surprised that Uno Platform is not a founding member of the Alliance. AFAIK, they are the most devoted group for WASM (hope not offending you). I use Uno Platform to make WASM apps with ease and pleasure. The current major issue is the long startup time. Hope there will be a significant improvement in this area soon.
pasttense01 7y ago
And a key point: "Our founding members are Mozilla, Fastly, Intel, and Red Hat" Where are Google, Microsoft and the other big names you would expect?
- cpeterso 7y ago
  Google and Microsoft probably don't have much use for WebAssembly outside the browser, whereas companies like Fastly and Cloudflare run customers' untrusted WebAssembly on their edge server networks.
  - deleted 7y ago
    [deleted]
- JoshTriplett 7y ago
  We launched the Alliance to formalize collaboration on pre-existing projects we were all already collaborating on. We'd love to collaborate with others as well, and we're having a lot of additional conversations at the moment.
- giancarlostoro 7y ago
  I'm sure they'll join sooner or later. Don't forget Apple.
- big_chungus 7y ago
  > Where are Google, Microsoft and the other big names you would expect? Those folks are the incumbents. What do they have to gain from joining? Google especially has developed a colossal amount of tooling in-house that gives it an edge over others; new tech may make the lives of competition easier. Ditto to an extent for MS, though there, I suspect it's more bureaucracy and not seeing anything to gain.
  - pjmlp 7y ago
    After all MSIL already supported multiple languages, including C++, back in 2001.
giancarlostoro 7y ago
I saw a comment about this on HN before, forgot who it was by. But it was interesting, someone mentioned the spec for WebAssembly is generic enough to apply outside of the web. I'm suspecting we'll see languages converting on node.js a la web assembly for back-end logic in your preferred language, but in any runtime this includes NodeJS but also excludes it as we see future runtimes. What's your view on this? Also, Aside from WebAssembly being in every modern browser what do you think will be the next killer feature for WebAssembly? It would also be interesting to have an embedded WebAssembly plugin runtime, much like Lua is used all over now that you mention all those examples.
- JoshTriplett 7y ago
  > someone mentioned the spec for WebAssembly is generic enough to apply outside of the web Absolutely. The spec provides a set of instructions and their semantics. Browsers provide a set of common runtime APIs. Non-browser environments can provide the sandbox with any API surface area they want. > in any runtime this includes NodeJS but also excludes it as we see future runtimes node.js is working on WASI support, and I'd also expect to see versions of JavaScript that run inside the WebAssembly sandbox. When we say "any language", that includes people who want to run JavaScript. > Aside from WebAssembly being in every modern browser what do you think will be the next killer feature for WebAssembly? Shared-nothing linking; libraries that don't have to trust each other with their entire address space. I see WebAssembly as the future plugin interface for any software that wants to be extensible. > It would also be interesting to have an embedded WebAssembly plugin runtime, much like Lua is used all over now that you mention all those examples. wasmtime is easy to embed; it only takes a handful of lines to load a WebAssembly file, hand it a few functions of your choice, and run it. See https://github.com/bytecodealliance/wasmtime-demos https://github.com/bytecodealliance/wasmtime-demos for various demos of how to embed wasmtime.
  - syrusakbary 7y ago
    Following up from your comment, if you want to start running WASI modules on Node.js (or in the Browser) today, you can use this npm package! (same API as future Node WASI integration) https://www.npmjs.com/package/@wasmer/wasi https://www.npmjs.com/package/@wasmer/wasi
azakai 7y ago
In my opinion this is a fascinating approach, and it may end up transforming our industry. But the main question I've had is how big the overhead is, specifically since modules don't share their wasm Memory. That means data will be constantly copied between them. Compared to regular static or even dynamic linking, that may be a noticeable slowdown.
- SkyMarshal 7y ago
  I’d rather start with something provably secure and slower, and then optimize its performance and features over future iterations and versions. Starting with speed and trying patch in security doesn’t seem to make things actually secure.
- JoshTriplett 7y ago
  > specifically since modules don't share their wasm Memory. That means data will be constantly copied between them. We're working on that. We want to make it possible for modules to share memory in a controlled way, without giving access to their entire address space.
  - azakai 7y ago
    Interesting! Is that written up somewhere public?
    - JoshTriplett 7y ago
      Some of it; see https://hacks.mozilla.org/2019/08/webassembly-interface-types/ https://hacks.mozilla.org/2019/08/webassembly-interface-type... for the starting point that this will be based on.
      - azakai 7y ago
        Oh, where? I don't think I see anything about controlled memory sharing there, but I guess I missed it. Which section is it in?
bestouff 7y ago
Don't take it bad, but it looks like the java launch a (long) while ago. What makes wasm better than java ?
- JoshTriplett 7y ago
  The toolchains for building WebAssembly from numerous languages, for one thing. The existence of an LLVM WebAssembly backend helps. (While eventually there were other languages that targeted the JVM, for a long time if you wanted the JVM sandbox you had to write Java.) WebAssembly also provides a fine-grained API surface area; you can run a WebAssembly sandbox with no external functions provided, or just a few. WebAssembly's sandboxing isn't tied to the web; we're keeping all the same security properties when running code locally, and we're protecting modules from each other too. Also, the WebAssembly bytecode format is designed from the beginning to support many different kinds of languages, including languages that directly store types in memory, rather than keeping everything as garbage-collected or reference-counted objects on the heap.
  - beefhash 7y ago
    > The existence of an LLVM WebAssembly backend helps. So why aren't people just shipping straight up LLVM intermediate language VMs and instead go through wasm? Incidentally, would you consider wasm as a destination language for virtual machines for obfuscation? I.e. is it reasonable enough to implement it all in about a week? Plus I fear like the decompilation/disassembly tooling might be there too soon for it to be a real viable option, but maybe nobody's been working on that yet.
    - est31 7y ago
      LLVM IR is an unstable format, changes a lot and only has one implementation.So it's not well suited for a standard. Google actually did use it for PNaCl but fortunately Mozilla prevailed when wasm was created. "Do what LLVM does" is not a valid strategy. On a related note, I'm glad that Firefox doesn't support the "Do what sqlite does" WebSQL api either, but Chrome (sadly) does.
sparker72678 7y ago
Super cynical, I realize, but whenever I see the description “secure by default” for something computer related, and they don’t mean, “we unplugged it,” I assume what they really mean is, “we made the code so complex we can’t find the problems.”
- forkerenok 7y ago
  Well, you should really read it as "eliminating certain class(es) of vulnerabilities".
- chubot 7y ago
  I suggest reading the WebAssembly paper: Bringing the web up to speed with WebAssembly https://scholar.google.com/scholar?cluster=14979605902538775118&hl=en&as_sdt=0,5&sciodt=0,5 https://scholar.google.com/scholar?cluster=14979605902538775...
- naasking 7y ago
  Instead, they mean something sensible: that permission has been linked with designation as per capability security. Adding feature extensions are thus linked with the authorities required to implement those features, and the modules implementing those features can't do anything behind the scenes. So you would no longer be able to amplify a string value into a file descriptor as you can in systems with ambient authority (which is nearly every system in widespread use today). So "secure by default" here means, "programs conform to least privilege".
- deleted 7y ago
  [deleted]
xvilka 7y ago
Radare2[1] supports WebAssembly disassembling if anyone is curious about compiled code analysis. [1] https://github.com/radareorg/radare2 https://github.com/radareorg/radare2
greatgib 7y ago
So much bullshit, in the end just to strip a little bit more the user and the developer of any liberty. The dream of us corp controlled appstore for pc desktops. Who will control what you can do through the sandbox? Intel, Mozilla, Google... So one day your soft will have to be signed by them and will refuse to let you adblock ... For your own safety...
- Ar-Curunir 7y ago
  ... this project prevents others from executing arbitrary malicious code on your computer. If you want to fiddle with your own computer, you can write your own code to do exactly that
- eeZah7Ux 7y ago
  Spot on. Websites will turn from bloated to extremely bloated. Shipping 5 MB of bytecode will help with: * Obfuscating dark patterns e.g. aggressive fingerprinting based on hardware, OS, cache contents, timing * Breaking ad blockers * Breaking tracking blockers like Privacy Badger * Preventing uBlock Origin from removing annoying elements * Preventing scraping * Offering different prices for goods and services based on the hardware and software (as it happened before)
  - eeZah7Ux 7y ago
    More downvotes?
- AgentME 7y ago
  When you use WebAssembly, you're in control of the sandbox. You can pass things into the sandbox and let the module use it. There's no signing/certificate/appstore system tied to WebAssembly.
  - greatgib 7y ago
    How is this different from current web browsers for running JavaScript apps? Don't you think there is lockdown now?
syrusakbary 7y ago
First of all, congrats on forming the alliance! > Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data That's what we are working towards on Wasmer, the server side WebAssembly runtime - https://github.com/wasmerio/wasmer https://github.com/wasmerio/wasmer In fact, we already have a lot of different language integrations (maintained by us and the community) and our software is the pioneer on the space. Is there any reason on why you think is a good idea to do a side-alliance instead of collaborating with us and the community so users and developers can be the ultimate beneficiaries? (it's good, it just seems is not an alliance made for the users, which it's a bit weird from my perspective)
- npmccallum 7y ago
  Disclaimer: I'm from the Enarx project (https://enarx.io https://enarx.io) which is associated with the BytecodeAlliance. I think a good analogy is: wasmer is to qemu as BytecodeAlliance is to rust-vmm. Wasmer is a general purpose WASM runtime. But BytecodeAlliance is a place to build tooling for the construction of runtimes (WASM or otherwise), including special purpose runtimes. I think there is a lot of space for both in the growing non-browser WASM market.
  - syrusakbary 7y ago
    Agreed! (regarding the non-browser WASM market) Not sure if I got the analogy, but all I can say is that I'm very excited about the Enarx initiative :)
  - jedisct1 7y ago
    How does Enarx differ from MesaTEE?
- baybal2 7y ago
  > First of all, congrats on forming the alliance! No Google on board, it means no Chrome support
  - amaranth 7y ago
maxk42 7y ago
Real worried when I see phrases like "secure by default" that this will involve some sort of security certificate or formal verification process which a government or other malicious actor can use as a weapon against its enemies. Is the security limited to sandboxing of the code itself or is there some sort of verification process involved?
- JoshTriplett 7y ago
  The security here is based on sandboxing code and providing limited capabilities. If you're embedding wasm, you choose what capabilities to give the sandbox. For instance, if a game wants to support mods via wasm, it could give the mods APIs to the game world but not to the network or filesystem. A database plugin might have access to interpret a database object handed to it but not exfiltrate data over the network. We're providing mechanisms here, not identity-based policies.
  - pjmlp 7y ago
    What about fixing the lack of bounds checking when multiple data elements are mapped into the same linear memory block? This leaves the door open for trying to influence behaviour of C and C++ generated WebAssembly modules, by corrupting their internal state via invalid data.
    - saagarjha 7y ago
      If you give a sandbox a capability and then there’s a bug in it, there’s always a chance that it will maliciously access those privileged resources. The only way I can see of protecting against logic bugs like these is better tooling.
      - pjmlp 7y ago
        Yeah, but then one should acknowledge those issues, and not advocate WebAssembly as if there weren't hundreds of other attempts since the late 50's.
rkeene2 7y ago
One of my next projects is to create a Tcl package for webassembly that will let other extension authors compile their packages targeting WebAssembly and be able to use those compiled binaries on any platform.
- JoshTriplett 7y ago
  That sounds great! I'd love to hear more about that. Are you looking to support extension of Tcl with WebAssembly, or using Tcl inside WebAssembly? I think wasmtime would likely be a good fit for your use case; you could either use the wasmtime C API, or use Rust to bind to Tcl and to the wasmtime-api Rust crate. I've found it quite easy to embed wasmtime and run a simple WebAssembly module. See https://github.com/bytecodealliance/wasmtime-demos https://github.com/bytecodealliance/wasmtime-demos for some samples of how to do so.
  - rkeene2 7y ago
    This is going to be a Tcl extension named "webassembly" that then allows you to load other Tcl extensions that are compiled to WebAssembly. Right now Tcl loads binary extensions using the "load" command, this will load a shared object (.so, .dylib, .shlib, .dll, .a, whatever your OS supports for runtime loading) and call <ExtensionName>_Init. My plan is to create a new command named "webassembly::load" that will open a WebAssembly module and provide ... some way ... to call <ExtensionName>_Init as well as some way for the extension to make calls back the ~200 Tcl API functions and some selected other APIs per platform (Solaris, AIX, FreeBSD, Linux, Windows, macOS, HP-UX, etc). Additionally, a mechanism (probably in the form of an SDK) for Tcl Extension maintainers to compile their extension targeting being loaded by "webassembly::load" with the APIs mentioned above being available. Most Tcl extensions right now are written in C or C++.
    - JoshTriplett 7y ago
      Makes perfect sense. I look forward to seeing your work when it's ready! Please feel free to ask if there's anything we can do to help, or if you run into any areas where the APIs could be easier to use. You may find the witx project (https://github.com/WebAssembly/WASI/tree/master/tools/witx https://github.com/WebAssembly/WASI/tree/master/tools/witx) useful when writing the bindings from WebAssembly to the Tcl APIs.
pjmlp 7y ago
WebAssembly keeps trying to be the next UNCOL, it seems.
AaronFriel 7y ago
Does this mean we'll also have a mechanism like pledge(2) to assert that the root nanoprocess or any privileged brokers only needs access to certain APIs, and permanently close them? ¹ - https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2
- JoshTriplett 7y ago
  The WASI and Bytecode Alliance approach is based on capability-based security, granting only the access needed for a module to do its job.
  - tschneidereit 7y ago
    To expand on this, capabilities allow us to go further than pledge(2): it enables selective forwarding of capabilities to other nanoprocesses, such as only forwarding a handle to a single file out of a directory, or a read-only handle from a read-write one, etc...
    - jedisct1 7y ago
      Capabilities are also more complicated. I fear that at the end of the day, capabilities will have the same fate as other sandboxing mechanisms: nobody will use them. And, just so that their application works and avoid support burden, developers will tell people to use a setup that enables access to everything. pledge(2) and unveil(2) learned from the past and are way simpler. I really wish WebAssembly had adopted similar mechanisms.
      - tschneidereit 7y ago
        Agreed, and there are a lot of UX questions to sort out. Many security concepts took many attempts to figure out in full (or to the extent that they have been figured out :)) One important aspect here is that this doesn't just target whole apps. It also targets developers using dependencies: while it's desirable to restrict an application's capabilities, there's a lot of value in developers only giving packages they depend on very limited sets of capabilities. And that seems much more tractable, given that kitchen-sink packages aren't what most people want to use anyway.
vanderZwan 7y ago
I was talking with a colleague today who mentioned that he had looked at WASM for a particular use-case (file-verification IIRC) and had concluded that for now the overhead of copying memory made it run worse than well-written JavaScript. It is also my experience that the overhead of memory copying can really put a damper on performance improvements. Now, I get that sharing memory is a huge safety issue - it kind of inherently breaks the sandbox, but when I see the "nanoprocesses" bit in the article I worry about death by a thousand paper cuts (lots of tiny WASM module spending more time copying data than processing it). Are there ways/plans to minimize memory copies that don't conflict with the safety concerns?
- JoshTriplett 7y ago
  There will be ways to memory-map files, share memory between modules, and otherwise avoid copying memory unnecessarily. Shared memory doesn't break the sandbox. Sharing all memory by default would, but controlled sharing of specific memory doesn't. Think of it like inter-process shared memory, rather than threads sharing an entire address space.
  - vanderZwan 7y ago
    Right, I was being sloppy - I guess was really thinking "memory addresses", not "memory". Anyway, that's great to hear! Any suggestions for discussions and such that one could follow to see how it develops?
  - lambda 7y ago
    Reading through this, this sounds like mostly a capability based architecture, with process isolation replaced with a statically typed bytecode in which you can verify that each module can only use capabilities passed to it. I was wondering why the focus on copying memory between the processes. It should be possible to make capabilities which represent a pointer and a length (and maybe an access mode), which could be used to give a process direct access to shared memory safely. I don't know if that could be done with low enough overhead for small objects, it's possible that there would need to be a threshold below which you would just copy values to be efficient, but it seems like exploring fat pointer capabilities would be worthwhile. Memory mapping files or inter-process shared memory is the very coarse-grained version of this, using hardware protection. I feel like it should be possible to do something more efficient and finer grained with pointer capabilities and the static type checking that is done to verify WASM during compilation, but it may be a significant research project of its own.
Animats 7y ago
The primary use case for WebAssembly is malware.[1] We're probably going to regret letting WebAssembly into the browser. Because vendors won't let it be locked down so much that it can't be used for ads and tracking. Which means it has to allow malware. [1] https://www.tu-braunschweig.de/Medien-DB/ias/pubs/2019-dimva.pdf https://www.tu-braunschweig.de/Medien-DB/ias/pubs/2019-dimva...
- shmolyneaux 7y ago
  Thanks for the reference. Just so it's clear, the definition of "malware" used here is in-browser crypto mining and obfuscation. Only 1 in 600 of the top 1 million sites use WebAssembly. WebAssembly doesn't actually provide a new vector for malware.
  - mantap 7y ago
    WebAssembly is still very immature. It unsurprising that it has such a low adoption right now. I think the real problem with webassembly would be if it becomes too popular and starts to become a JS competitor rather than a complement to JS.
    - pjmlp 7y ago
      WebAssembly is the revenge of Flash/Java/ActiveX, but this time everything will turn out perfect, as per WebAssembly advocacy.
      - DonHopkins 7y ago
        Hey don't forget Shockwave. That was the thing that totally took over the web that everybody hated before Flash.
      - mantap 7y ago
        Honestly, given the lack of tooling they have now, it is pretty much perfect from a user's perspective. You are only going to use WASM if you absolutely need the performance. It's just too painful otherwise.
deleted 7y ago
[deleted]
nabla9 7y ago
JVM was supposed to be this. Gosling said publicly that JVM is more important than Java. . Many things went wrong. Microsoft was actively sabotaging JVM. They implemented very fast JVM for Explorer and their operating system that intentionally broke the JVM 1.1 standard. See Sun vs Microsoft 1997. Microsoft lost and paid damages. .NET was created to do more damage.
- jdance 7y ago
  I like the JVM and have done lots of code for it, but the java download&install / setting up PATH / non native gui-look / no exe-files / should i get se/ee/jre/sdk etc etc must be a big contributing factor to its lack of being more popular (client side). A lot of the experience has been clumsy, ugly and unintuitive from the start
  - pjmlp 7y ago
    WebAssembly developer experience is also not the most friendly one, with its mix of toolchains, specially if one is on Windows. Oh, and debugging is still at printf level style and reading raw bytecodes.
    - callahad 7y ago
      > debugging is still at printf level style and reading raw bytecodes Wasmtime has had support for source-level debugging via lldb or gdb for a few months https://hacks.mozilla.org/2019/09/debugging-webassembly-outside-of-the-browser/ https://hacks.mozilla.org/2019/09/debugging-webassembly-outs...
      - pjmlp 7y ago
        That doesn't look like production ready, nor integrated into browser developer tools.
  - kasperni 7y ago
    Which, is also why that method for delivering applications has been deprecated for a couple of years. Now, the prefered way to ship a Java application is to bundle the runtime and the application into a single installer similar to, for example, Electron apps.
Ajedi32 7y ago
This is great. I've been waiting for a module-level permissions system for a while now; it definitely seems like the best approach to mitigate supply chain attacks. Hopefully once WASM has demonstrated the principle other languages will follow. This seems like it'd be especially useful in the JS ecosystem, where many modules are already small enough that they'd likely be able to run with no permissions at all.
stefan_ 7y ago
This is historically the kind of thing that people think is very cool and important, but has turned out to not matter at all. "Languages matter" must be the biggest enduring fallacy of computer programming. It has an obvious corollary in believing processor architectures are important.
- weberc2 7y ago
  It matters a whole lot. There's lots of code written in various languages and it's often prohibitive to use it in your own project because making the languages speak with each other (especially if you have performance concerns) is a lot of work. I don't expect WASM to make this trivial, but to say that it doesn't matter is patently wrong.
  - gridlockd 7y ago
    I think the point is that your laundry list of features in your language of choice does not really matter when it comes to adoption. For instance, memory safety does not really matter so much that people would stop using unsafe languages.
  - zzzcpan 7y ago
    Why high level languages should be able to easily speak with each other? Wouldn't this defeat the purpose of having more than one language, since they would be effectively identical?
- AgentME 7y ago
  The cross-language interoperability of WebAssembly seems practically like a happy side-effect of its design; I don't think it would look much differently at present if it had originally been built to target only C (in a sandboxable way). Most of the article still applies even if you ignore other language support. The first priority for WebAssembly seems to be making things strongly sandboxed.
  - pjmlp 7y ago
    Actually it fails to properly sandbox C derived languages versus what hardware memory tagging like SPARC ADI and ARM are capable of, because it doesn't do bounds checks inside linear memory blocks.
Narishma 7y ago
Are those drawings supposed to be clickable? When I do so, it just opens and immediately closes a new tab or window. Firefox 70 on Windows if it makes a difference.
- arendtio 7y ago
  Works for me. Opens a new tab with an image, e.g.: https://2r4s9p1yi1fa2jd7j43zph8r-wpengine.netdna-ssl.com/files/2019/11/featured-image.png https://2r4s9p1yi1fa2jd7j43zph8r-wpengine.netdna-ssl.com/fil... FF 70 on Arch Linux.
  - Narishma 7y ago
    That's weird. In fact it does the same with your link, though I can open it in the same tab. If I try to open it in a new tab or window, it just closes immediately.
- jml7c5 7y ago
  Bad adblock filter, maybe?
  - Narishma 7y ago
    Yup, that was it. Disabling the ad blocker fixed this.
- deleted 7y ago
  [deleted]
seph-reed 7y ago
Been working with web tech since 2000... something about WASM rubs me the wrong way, at least for use in the web. It's probably the lack of human readable source code (I'm not a big fan of minified code for the same reason). If it wasn't so impossible to work with W3C, I think it would probably make more sense for the web to work towards something like more strict, compilable typescript. Then sites could download the source, compile, and cache.
Hitton 7y ago
>So how can you protect your users against these threats in today’s software ecosystem? >You could subscribe to a monitoring service that alerts you when a vulnerability is found one of your dependencies. But this only works for those that have been found. And even once a vulnerability has been found, there’s a good chance the maintainer won’t be able to fix it quickly. For example, Snyk found in the npm ecosystem that for the top 6 packages, the median time-to-fix (measured starting at the vulnerability’s inclusion) was 2.5 years. Sometimes it looks like writers think that the average reader is complete idiot. How is that supposed to be example? First they say that it takes long time fix once the bug is found and as illustration they give period starting with introduction of vulnerability?
- hinkley 7y ago
  We can't even get software developers to use sane metrics. Good luck getting Masters of Fine Arts people to use them property to describe software. Especially when we've provided such a stellar example.
gwbas1c 7y ago
Wait... I thought the CLR was supposed to do this? Or was it the JVM? What's old is new again!
- pjmlp 7y ago
  Or UNCOL, or Xerox Pilot and Dorado microcoded CPUs, or IBM z/OS and OS/400 language environments, or VMS multi-language backends, or PNaCL, or ....
  - dboreham 7y ago
    You forgot the UCSD P-System.
    - pjmlp 7y ago
      It is included on the .... :)
      - DonHopkins 7y ago
        ...That reminds me of a cartoon I saw in an old Apple ][ magazine: (One kid talking to another, with dad in the background hunched over an Apple ][.) "Daddy's playing UCSD Pascal. That's the game where you try and see how many dots you can get before it beeps and you say nasty words." http://bitsavers.trailing-edge.com/pdf/ti/professional/p-system/2232399-0001_UCSD_p-System_Program_Development_Software_Library_Apr1983.pdf http://bitsavers.trailing-edge.com/pdf/ti/professional/p-sys... UCSD p-System Program Development (p. 2-4) While the compiler is running, it displays a report of its progress on the screen in this manner: Pascal compiler - release level VERSION < 0> ................... INITIALIZE < 19> ....................................... AROUTINE < 61> ....................................... < 111> ....... MYPROG < 119> ...................................... 237 lines compiled INITIALI . MYPROG .. During the first pass, the compiler displays the name of each routine. In this example, INITIALIZE, AROUTINE, and MYPROG are the routines. The numbers enclosed within angle brackets, < >, are the current line numbers and each dot on the screen represents one source line compiled.
muricula 7y ago
How can I learn more about how nanoprocesses and the wasmtime sandbox work under the hood? Searching the repo on github for common keywords doesn't turn up much. Are nanoprocesses like Windows picoprocesses somehow, or are multiple "processes" running in the same address space? If so, you can probably exfiltrate data between nanoprocesses with spectre. Additionally, if you get RCE in the wasm JIT (this happens all the time in javascript JITs), there's nothing to stop you from ropping to gadgets to open your own sockets without going through any in-process checks.
- saagarjha 7y ago
  > or are multiple "processes" running in the same address space Yes. > If so, you can probably exfiltrate data between nanoprocesses with spectre. Right, this is mentioned in the article. (TL;DR if this is a concern for you don’t use the sandbox, at least not until someone’s figured out how to implement timing protection.
cm2187 7y ago
Stupid question from a non specialist. I see Intel in the list of parties. Does that mean hardware acceleration for wasm?
- BubRoss 7y ago
  It is meant to be compiled to native instructions, I don't think there is significant room for hardware acceleration.
  - cm2187 7y ago
    I am talking from a position of ignorance, but intuitively I am sure the runtime does or will do lots of things, between the sandboxing, the linking, potential garbage collection, etc.
    - BubRoss 7y ago
      It isn't run through a run time, it is meant to be just in time compiled to native instructions. There isn't any garbage collection.
- JoshTriplett 7y ago
  Among other things, yes; we're contributing to the SIMD support, for instance.
  - markdog12 7y ago
    Anything beyond just the 128-bit SIMD yet? Last thing I seen on that was "Long SIMD" from here: https://webassembly.org/docs/future-features/ https://webassembly.org/docs/future-features/ And that was years ago. Seems like an awful waste to have many millions of cpus with avx for instance, wasted.
- deleted 7y ago
  [deleted]
rb808 7y ago
Can you use wasm instead of regular js/html? I'm thinking for rich GUIs it would be great, even just for company internal sites. I can't find any good examples though.
- hellofunk 7y ago
  Rust has libraries for this.
- code_code 7y ago
  I have a recent note that says (from HN id=21495338), try makepad.github.io/makepad . My recollection is that this is such an example.
  - rb808 7y ago
    Nice! though confusingly its an editor that run JavaScript pages. https://makepad.github.io/makepad.html https://makepad.github.io/makepad.html
- tiborsaas 7y ago
  Yes, of course, you can draw anything on a regular HTML canvas and all you need is a thin layer of JS to do some interfacing. However, I'd discourage you build complex GUI-s in WA. If you do that it means that you have to reimplement everything how the browser works and your end users are accustomed to.
- jedisct1 7y ago
  Check out Microsoft Blazor.
  - rb808 7y ago
    Actually this looks great.
FpUser 7y ago
Not in a mood of diving deep into technical details but forgive me for being skeptical. This "secure by design" execution mantra makes me somewhat sick after hearing it so many times over the decades.
lone_haxx0r 7y ago
What's the main difference between this and the Java Virtual Machine?
devwastaken 7y ago
There should not be a 'browser wasm' and a 'non browser' wasm. The wasm committee made many mistakes by treating it as an idea on paper, and not writing the actual implimenting software. This has resulted in significant fragmenting of implimentation, each less trustworthy than the last. If any software is going to advertise safety, it must prove it. That's done through the feedback cycle and careful development. The only ones that have this are in browsers. Yet browsers have their own dubious implimentation, integrated with their JavaScript environment. Unless wasm decides on a set of standard runtimes that become trustworthy there will not be a wasm outside the browser. For example, when I search for python, I get python. There's still other pythons, but there's the python. This is true of all other software used. Wasm is failing to do that.
- dgellow 7y ago
  Try searching for C, C++, or even SQL or Javascript. You will quickly see that you don’t have “the official implementation”, because that’s not how things work in practice when considering well standardized and widely used software.
  - devwastaken 7y ago
    You're mistaking written standard for implimentation standard. You only need a standard in practice. All of those things you've listed have only a few big players, with enough use and feedback cycle that there can be multiple different implimentations. Those different implimentations are very similar. There is not a different C to compilers, they have their own quirks, benefits, and target different systems. JavaScript is the least selective of any language, you will only find runtimes for it's modern versions in browsers Typically V8 or safari. V8 has become the effective standard. SQL has multiple big implimentations that deviate completely. This has a lot to do with marketing, and the fact data storage/retrieval is a significantly diverse section of computer science. In each of these known technologies there is a well known, well backed, named software project that people use it's name synonymous with it's supposed standard. Wasm doesn't have this, and that's because the implimentations took place in browser, which afaik did not impliment a unique engine to it. It just integrates wasm instructions to their js instructions. Which then led to there being dozens of different self called 'safe' implimentations. None of these have the users, time, and open source community necessary to know this. Which will inevitably lead to exploits. Given that situation, the only way wasm is going to live up to its goal of safety is backing a well made runtime. The problem of safety is what makes this very different from other software. Your own code with bugs is an annoyance, and maybe you can't do what you wanted. But code that is meant to be safe that instead allows for damage to you, your company - that deserves a much higher level of scrutiny.
gatestone 7y ago
This is getting complicated. OS process management, threads and lightweight pocesses, green field process control, virtual machines, containers, sandboxing in n browsers with m different technologies, now this WASM stuff..and orchestrating this all across the cloud and the global internet, ending in homes and corporate machine rooms. Enverywhere you have to think: who can load/run a module/process and from where, how to authenticate and authorize, which API to give to it, etc... A historical note: Bell Labs Plan 9 had a universal OS level solution, that Linux has somewhat adopted, but could not make general enough, partly due to the higher lever ecosystem being stuck to old ways: - per process name spaces with mountable/inheritable/stackable union directories and optionally sharebale memory (Linux light-weight process, LWP, comes close, it was also historically copied from Plan 9) - Almosty all APIs (even "system calls") as synthetic file systems (Where do you think /proc came from?) - which you could mount and access (efficiently) locally or through a secure unified network protocol (9P) On Plan 9 you could just run different parts of the browser (JavaScript engine, WASM or anything) in a tailored limited LWP with limited mounts as synthetic file system APIs... Note that Docker kind of retro-fits Plan 9 ideas in Linux kernel to embrace and extend the original ideas of Plan 9...
- wahern 7y ago
  > Where do you think /proc came from? UNIX 8th Edition (http://lucasvr.gobolinux.org/etc/Killian84-Procfs-USENIX.pdf http://lucasvr.gobolinux.org/etc/Killian84-Procfs-USENIX.pdf) and SRV4 (https://www.usenix.org/sites/default/files/usenix_winter91_faulkner.pdf https://www.usenix.org/sites/default/files/usenix_winter91_f...) A better analogy would be /dev, but that was already part of Unix from the beginning. Plan 9 is really about per process, user mountable namespaces implemented by 9P-speaking user processes; basically what you said, sans the origin of synthetic file systems and file-like objects.
jeltz 7y ago
One pretty annoying thing with WASM is that it is pretty hard to generate due to requiring a structured control flow so anyone generating it must implement relooper och stackifier. Is there any work on solving this issue? http://troubles.md/posts/why-do-we-need-the-relooper-algorithm-again/ http://troubles.md/posts/why-do-we-need-the-relooper-algorit...

407 points by markdog12 7y ago

I'm one of the folks working with the Alliance, and I'm incredibly excited about WebAssembly outside the browser. Happy to answer questions. Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data. Imagine supporting a safe plugin API that isn't just for C and languages that FFI to C, but works natively with safe datatypes. Today, if you want to be extensible, you typically expose a C API for people to link to, or you embed a specific language like Lua or Python. Imagine embedding a WebAssembly runtime like wasmtime, and telling people they can write their extensions in any language they want.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
Jyaif 7y ago
Will this work on platforms that do not allow JIT compilation?
- JoshTriplett 7y ago
  Lucet supports ahead-of-time compilation, and WAMR provides an interpreter.
  - tschneidereit 7y ago
    And Wasmtime will also support both of those. Support for environments in which JITting is not an option is of course really important to this!
ctz 7y ago
The post mentions: > tiny IoT device But, I've looked at this in the past and concluded wasm was a pretty poor fit for small devices: 1) it only addresses memory in 64KB pages (perhaps more SRAM than you might have) and 2) requires both single and double float support. (1) might be possible to work-around by backing the memory space with smaller page allocations -- at the cost of indirection for every memory access. (2) seems pretty insurmountable -- it'll just need a chunk of extra C library. Are you aware of any projects working on this for smallish microcontrollers?
- JoshTriplett 7y ago
  You don't have to support floats; you can, for instance, support loading and validating WebAssembly modules only if they don't use any floating-point operations.
  - wahern 7y ago
    Much like C, which also requires floating point support. WebAssembly implementations for tiny IoT environments can emulate floating point in reliance on people not using it heavily, just as you'd expect them not to run Node.js. But at least the developer has the option, which can have significant value, such as during exploration and experimentation phases. Similarly, compilers like GCC will synthesize 64-bit arithmetic inline for i386 and other targets lacking 64-bit support. These days few people think twice about using 64-bit data types even though 32-bit processors are still in heavy use. (Though, AFAIU emulation has largely moved from compiler to the instruction decoder or microcode.)
- afiori 7y ago
  > it only addresses memory in 64KB pages is this by the standard or implementations?
al2o3cr 7y ago
no ability to exfiltrate data As we've learned with things like rowhammer and Spectre, this is a very high bar. How does this initiative plan to deal with side-channel attacks?
- sunfish 7y ago
  This is discussed in the blog post; see the discussion of "time protection".
  - robocat 7y ago
    If you're just reading hn comments: "There is unfortunately one less straightforward way that attackers can access another module’s memory—side-channel attacks like Spectre. OS processes attempt to provide something called time protection, and this helps protect against these attacks. Unfortunately, CPUs and OSes don’t offer finer-than-process granularity time protection features." "[snip] Making a shift to nanoprocesses here would take careful analysis." "But there are lots of situations where timing protection isn’t needed, or where people aren’t using processes at all right now. These are good candidates for nanoprocesses." "Plus, as CPUs evolve to provide cheaper time protection features, WebAssembly nanoprocesses will be in a good position to quickly take advantage of these features, at which point you won’t need to use OS processes for this."
uwydr 7y ago
For the Horde!
jkoberg 7y ago
So, like, Java?
- JoshTriplett 7y ago
  https://news.ycombinator.com/item?id=21516212 https://news.ycombinator.com/item?id=21516212
- weberc2 7y ago
  > Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data How does Java preclude plugins exfiltrating data? Downvoters: I’m not trying to be sacrilegious; I genuinely don’t know the answer.
  - chii 7y ago
    You can use a security manager and define permission on what the loaded java code can do. Unfortunately, it's fraught with danger because of the confused lieutenant issue ( you'd need to give parts of the app permission but not others - doing so isn't trivial).
    - scolby33 7y ago
      Just to help others searching for "confused lieutenant," I believe it's usually known as the "confused deputy problem," perhaps as a reference to Barney Fife. I do like the image of a confused lieutenant though.
mrbonner 7y ago
I am very interested in the inter "process" comm (or, inter "module" comm to be precised). From the surface, this runtime and modular system look pretty similar to the based OSGi runtime plus OSGi security. Not that I wanted to scare folks here as OSGi has a bad reputation of being bloated :-)
weberc2 7y ago
I'm particularly interested in a world where wasm binaries replace (or supplement) containers (or even VMs?). I'm specifically imagining Kubernetes or AWS Lambda but with direct wasm execution (instead of wasm-in-container or wasm-in-VM). I'd be curious if anyone has put more thought into this and what possibilities they envision.
Narishma 7y ago
> Imagine embedding a WebAssembly runtime like wasmtime, and telling people they can write their extensions in any language they want. Is that desirable? Won't it lead to a bloated mess with every extension dragging in a different language runtime with it?
- kaetemi 7y ago
  Web developers don't seem to have any concern about using gigantic quantities of memory. Don't hire a web developer to develop for games. :)
  - StavrosK 7y ago
    It's almost as if spending time optimizing memory usage isn't worth it because server RAM is cheap!
    - bpt3 7y ago
      What does server RAM have to do with modern web development, where the vast majority of the work is done on the frontend?
- nine_k 7y ago
  With several programs using wasm, the runtimes can be shared, the way shared libraries work in modern OSes, or shared assemblies .net.
- 6nf 7y ago
  Yea but sometimes we are willing to run an entire nano linux in a WASM module if it helps launch a few days earlier!
simonebrunozzi 7y ago
> and I'm incredibly excited about WebAssembly outside the browser. What's your take on the browser, instead? Curious to hear your point of view. p.s. Thanks for working with the Alliance, I think it's great news overall.
devwastaken 7y ago
This isn't entirely accurate. Exploitations in whatever code is converted to wasm instructions still work inside the wasm memory space. As in, if you write your program in c, python, whatever, and put it in wasm, then have a wasm extension system of some sort - if that c or python is exploitable, then whatever external access that wasm instance has is now useable. And whatever memory is in the memory space can be modified. This is an important distinction. Wasm should be thought of as a tool to containerise execution and memory if the implimentation is proven to do so.
- vanderZwan 7y ago
  Does WASM let you run memory as code?
  - thekingofh 7y ago
    No. Marking memory as executable is a native machine level capability (as in x86_64 assembly machine instructions). Wasm is a stack machine interpreter that can read only Wasm binaries. The binary format is essentially just a compressed/minimized form of the bytecode format, which used to essentially be an AST of the original source code, but now I believe they modified it a bit to be more analogous to hypothetical machine code, but still abstracted. The Wasm interpreter does not understand x86 or ARM or whatever machine code it's fed it and rightly so. If that was possible, anyone could just send over a buffer to the browser to execute whatever they want.
    - vanderZwan 7y ago
      That's what I thought. Then that's one whole category of exploits that no longer applies, no?
      - thekingofh 7y ago
        Yes, assuming there's no flaws in the interpreter. But they're all moving full steam ahead in the browsers right now, so imagine it's deemed as safe as javascript. The current push is to divvy up the permissions of certain resources such as sockets and filesystem (browser code don't have filesystem access) and make an API to ensure that modules don't overstep their granted permissions. It'll probably look a lot like node and npm, where you could add a module to your source and know that it can't access things it shouldn't. Pretty exciting stuff. It's a true merger of all languages together under one runtime.
thekingofh 7y ago
Is there a plan to bring together a bunch of these extensions under one roof with a package/dependency manager similar to cargo or npm, or is it intended to be glued together on the developer side? To me this looks massive, like to be able to pull down modules knowing what permissions they need, and to be able to have some kind of assurances that the code can't misbehave.
hz10 7y ago
Fantastic! Since I made quite a few Silverlight RIAs, WASM is like Silverlgitht on steroids. I am surprised that Uno Platform is not a founding member of the Alliance. AFAIK, they are the most devoted group for WASM (hope not offending you). I use Uno Platform to make WASM apps with ease and pleasure. The current major issue is the long startup time. Hope there will be a significant improvement in this area soon.

pasttense01 7y ago

And a key point: "Our founding members are Mozilla, Fastly, Intel, and Red Hat" Where are Google, Microsoft and the other big names you would expect?

cpeterso 7y ago
Google and Microsoft probably don't have much use for WebAssembly outside the browser, whereas companies like Fastly and Cloudflare run customers' untrusted WebAssembly on their edge server networks.
- deleted 7y ago
  [deleted]
JoshTriplett 7y ago
We launched the Alliance to formalize collaboration on pre-existing projects we were all already collaborating on. We'd love to collaborate with others as well, and we're having a lot of additional conversations at the moment.
giancarlostoro 7y ago
I'm sure they'll join sooner or later. Don't forget Apple.
big_chungus 7y ago
> Where are Google, Microsoft and the other big names you would expect? Those folks are the incumbents. What do they have to gain from joining? Google especially has developed a colossal amount of tooling in-house that gives it an edge over others; new tech may make the lives of competition easier. Ditto to an extent for MS, though there, I suspect it's more bureaucracy and not seeing anything to gain.
- pjmlp 7y ago
  After all MSIL already supported multiple languages, including C++, back in 2001.

giancarlostoro 7y ago

I saw a comment about this on HN before, forgot who it was by. But it was interesting, someone mentioned the spec for WebAssembly is generic enough to apply outside of the web. I'm suspecting we'll see languages converting on node.js a la web assembly for back-end logic in your preferred language, but in any runtime this includes NodeJS but also excludes it as we see future runtimes. What's your view on this? Also, Aside from WebAssembly being in every modern browser what do you think will be the next killer feature for WebAssembly? It would also be interesting to have an embedded WebAssembly plugin runtime, much like Lua is used all over now that you mention all those examples.

JoshTriplett 7y ago
> someone mentioned the spec for WebAssembly is generic enough to apply outside of the web Absolutely. The spec provides a set of instructions and their semantics. Browsers provide a set of common runtime APIs. Non-browser environments can provide the sandbox with any API surface area they want. > in any runtime this includes NodeJS but also excludes it as we see future runtimes node.js is working on WASI support, and I'd also expect to see versions of JavaScript that run inside the WebAssembly sandbox. When we say "any language", that includes people who want to run JavaScript. > Aside from WebAssembly being in every modern browser what do you think will be the next killer feature for WebAssembly? Shared-nothing linking; libraries that don't have to trust each other with their entire address space. I see WebAssembly as the future plugin interface for any software that wants to be extensible. > It would also be interesting to have an embedded WebAssembly plugin runtime, much like Lua is used all over now that you mention all those examples. wasmtime is easy to embed; it only takes a handful of lines to load a WebAssembly file, hand it a few functions of your choice, and run it. See https://github.com/bytecodealliance/wasmtime-demos https://github.com/bytecodealliance/wasmtime-demos for various demos of how to embed wasmtime.
- syrusakbary 7y ago
  Following up from your comment, if you want to start running WASI modules on Node.js (or in the Browser) today, you can use this npm package! (same API as future Node WASI integration) https://www.npmjs.com/package/@wasmer/wasi https://www.npmjs.com/package/@wasmer/wasi

azakai 7y ago

In my opinion this is a fascinating approach, and it may end up transforming our industry. But the main question I've had is how big the overhead is, specifically since modules don't share their wasm Memory. That means data will be constantly copied between them. Compared to regular static or even dynamic linking, that may be a noticeable slowdown.

SkyMarshal 7y ago
I’d rather start with something provably secure and slower, and then optimize its performance and features over future iterations and versions. Starting with speed and trying patch in security doesn’t seem to make things actually secure.
JoshTriplett 7y ago
> specifically since modules don't share their wasm Memory. That means data will be constantly copied between them. We're working on that. We want to make it possible for modules to share memory in a controlled way, without giving access to their entire address space.
- azakai 7y ago
  Interesting! Is that written up somewhere public?
  - JoshTriplett 7y ago
    Some of it; see https://hacks.mozilla.org/2019/08/webassembly-interface-types/ https://hacks.mozilla.org/2019/08/webassembly-interface-type... for the starting point that this will be based on.
    - azakai 7y ago
      Oh, where? I don't think I see anything about controlled memory sharing there, but I guess I missed it. Which section is it in?

bestouff 7y ago

Don't take it bad, but it looks like the java launch a (long) while ago. What makes wasm better than java ?

JoshTriplett 7y ago
The toolchains for building WebAssembly from numerous languages, for one thing. The existence of an LLVM WebAssembly backend helps. (While eventually there were other languages that targeted the JVM, for a long time if you wanted the JVM sandbox you had to write Java.) WebAssembly also provides a fine-grained API surface area; you can run a WebAssembly sandbox with no external functions provided, or just a few. WebAssembly's sandboxing isn't tied to the web; we're keeping all the same security properties when running code locally, and we're protecting modules from each other too. Also, the WebAssembly bytecode format is designed from the beginning to support many different kinds of languages, including languages that directly store types in memory, rather than keeping everything as garbage-collected or reference-counted objects on the heap.
- beefhash 7y ago
  > The existence of an LLVM WebAssembly backend helps. So why aren't people just shipping straight up LLVM intermediate language VMs and instead go through wasm? Incidentally, would you consider wasm as a destination language for virtual machines for obfuscation? I.e. is it reasonable enough to implement it all in about a week? Plus I fear like the decompilation/disassembly tooling might be there too soon for it to be a real viable option, but maybe nobody's been working on that yet.
  - est31 7y ago
    LLVM IR is an unstable format, changes a lot and only has one implementation.So it's not well suited for a standard. Google actually did use it for PNaCl but fortunately Mozilla prevailed when wasm was created. "Do what LLVM does" is not a valid strategy. On a related note, I'm glad that Firefox doesn't support the "Do what sqlite does" WebSQL api either, but Chrome (sadly) does.

sparker72678 7y ago

Super cynical, I realize, but whenever I see the description “secure by default” for something computer related, and they don’t mean, “we unplugged it,” I assume what they really mean is, “we made the code so complex we can’t find the problems.”

forkerenok 7y ago
Well, you should really read it as "eliminating certain class(es) of vulnerabilities".
chubot 7y ago
I suggest reading the WebAssembly paper: Bringing the web up to speed with WebAssembly https://scholar.google.com/scholar?cluster=14979605902538775118&hl=en&as_sdt=0,5&sciodt=0,5 https://scholar.google.com/scholar?cluster=14979605902538775...
naasking 7y ago
Instead, they mean something sensible: that permission has been linked with designation as per capability security. Adding feature extensions are thus linked with the authorities required to implement those features, and the modules implementing those features can't do anything behind the scenes. So you would no longer be able to amplify a string value into a file descriptor as you can in systems with ambient authority (which is nearly every system in widespread use today). So "secure by default" here means, "programs conform to least privilege".
deleted 7y ago
[deleted]

xvilka 7y ago

Radare2[1] supports WebAssembly disassembling if anyone is curious about compiled code analysis. [1] https://github.com/radareorg/radare2 https://github.com/radareorg/radare2

greatgib 7y ago

So much bullshit, in the end just to strip a little bit more the user and the developer of any liberty. The dream of us corp controlled appstore for pc desktops. Who will control what you can do through the sandbox? Intel, Mozilla, Google... So one day your soft will have to be signed by them and will refuse to let you adblock ... For your own safety...

Ar-Curunir 7y ago
... this project prevents others from executing arbitrary malicious code on your computer. If you want to fiddle with your own computer, you can write your own code to do exactly that
eeZah7Ux 7y ago
Spot on. Websites will turn from bloated to extremely bloated. Shipping 5 MB of bytecode will help with: * Obfuscating dark patterns e.g. aggressive fingerprinting based on hardware, OS, cache contents, timing * Breaking ad blockers * Breaking tracking blockers like Privacy Badger * Preventing uBlock Origin from removing annoying elements * Preventing scraping * Offering different prices for goods and services based on the hardware and software (as it happened before)
- eeZah7Ux 7y ago
  More downvotes?
AgentME 7y ago
When you use WebAssembly, you're in control of the sandbox. You can pass things into the sandbox and let the module use it. There's no signing/certificate/appstore system tied to WebAssembly.
- greatgib 7y ago
  How is this different from current web browsers for running JavaScript apps? Don't you think there is lockdown now?

syrusakbary 7y ago

First of all, congrats on forming the alliance! > Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data That's what we are working towards on Wasmer, the server side WebAssembly runtime - https://github.com/wasmerio/wasmer https://github.com/wasmerio/wasmer In fact, we already have a lot of different language integrations (maintained by us and the community) and our software is the pioneer on the space. Is there any reason on why you think is a good idea to do a side-alliance instead of collaborating with us and the community so users and developers can be the ultimate beneficiaries? (it's good, it just seems is not an alliance made for the users, which it's a bit weird from my perspective)

npmccallum 7y ago
Disclaimer: I'm from the Enarx project (https://enarx.io https://enarx.io) which is associated with the BytecodeAlliance. I think a good analogy is: wasmer is to qemu as BytecodeAlliance is to rust-vmm. Wasmer is a general purpose WASM runtime. But BytecodeAlliance is a place to build tooling for the construction of runtimes (WASM or otherwise), including special purpose runtimes. I think there is a lot of space for both in the growing non-browser WASM market.
- syrusakbary 7y ago
  Agreed! (regarding the non-browser WASM market) Not sure if I got the analogy, but all I can say is that I'm very excited about the Enarx initiative :)
- jedisct1 7y ago
  How does Enarx differ from MesaTEE?
baybal2 7y ago
> First of all, congrats on forming the alliance! No Google on board, it means no Chrome support
- amaranth 7y ago

maxk42 7y ago

Real worried when I see phrases like "secure by default" that this will involve some sort of security certificate or formal verification process which a government or other malicious actor can use as a weapon against its enemies. Is the security limited to sandboxing of the code itself or is there some sort of verification process involved?

JoshTriplett 7y ago
The security here is based on sandboxing code and providing limited capabilities. If you're embedding wasm, you choose what capabilities to give the sandbox. For instance, if a game wants to support mods via wasm, it could give the mods APIs to the game world but not to the network or filesystem. A database plugin might have access to interpret a database object handed to it but not exfiltrate data over the network. We're providing mechanisms here, not identity-based policies.
- pjmlp 7y ago
  What about fixing the lack of bounds checking when multiple data elements are mapped into the same linear memory block? This leaves the door open for trying to influence behaviour of C and C++ generated WebAssembly modules, by corrupting their internal state via invalid data.
  - saagarjha 7y ago
    If you give a sandbox a capability and then there’s a bug in it, there’s always a chance that it will maliciously access those privileged resources. The only way I can see of protecting against logic bugs like these is better tooling.
    - pjmlp 7y ago
      Yeah, but then one should acknowledge those issues, and not advocate WebAssembly as if there weren't hundreds of other attempts since the late 50's.

rkeene2 7y ago

One of my next projects is to create a Tcl package for webassembly that will let other extension authors compile their packages targeting WebAssembly and be able to use those compiled binaries on any platform.

JoshTriplett 7y ago
That sounds great! I'd love to hear more about that. Are you looking to support extension of Tcl with WebAssembly, or using Tcl inside WebAssembly? I think wasmtime would likely be a good fit for your use case; you could either use the wasmtime C API, or use Rust to bind to Tcl and to the wasmtime-api Rust crate. I've found it quite easy to embed wasmtime and run a simple WebAssembly module. See https://github.com/bytecodealliance/wasmtime-demos https://github.com/bytecodealliance/wasmtime-demos for some samples of how to do so.
- rkeene2 7y ago
  This is going to be a Tcl extension named "webassembly" that then allows you to load other Tcl extensions that are compiled to WebAssembly. Right now Tcl loads binary extensions using the "load" command, this will load a shared object (.so, .dylib, .shlib, .dll, .a, whatever your OS supports for runtime loading) and call <ExtensionName>_Init. My plan is to create a new command named "webassembly::load" that will open a WebAssembly module and provide ... some way ... to call <ExtensionName>_Init as well as some way for the extension to make calls back the ~200 Tcl API functions and some selected other APIs per platform (Solaris, AIX, FreeBSD, Linux, Windows, macOS, HP-UX, etc). Additionally, a mechanism (probably in the form of an SDK) for Tcl Extension maintainers to compile their extension targeting being loaded by "webassembly::load" with the APIs mentioned above being available. Most Tcl extensions right now are written in C or C++.
  - JoshTriplett 7y ago
    Makes perfect sense. I look forward to seeing your work when it's ready! Please feel free to ask if there's anything we can do to help, or if you run into any areas where the APIs could be easier to use. You may find the witx project (https://github.com/WebAssembly/WASI/tree/master/tools/witx https://github.com/WebAssembly/WASI/tree/master/tools/witx) useful when writing the bindings from WebAssembly to the Tcl APIs.

pjmlp 7y ago

WebAssembly keeps trying to be the next UNCOL, it seems.

AaronFriel 7y ago

Does this mean we'll also have a mechanism like pledge(2) to assert that the root nanoprocess or any privileged brokers only needs access to certain APIs, and permanently close them? ¹ - https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2

JoshTriplett 7y ago
The WASI and Bytecode Alliance approach is based on capability-based security, granting only the access needed for a module to do its job.
- tschneidereit 7y ago
  To expand on this, capabilities allow us to go further than pledge(2): it enables selective forwarding of capabilities to other nanoprocesses, such as only forwarding a handle to a single file out of a directory, or a read-only handle from a read-write one, etc...
  - jedisct1 7y ago
    Capabilities are also more complicated. I fear that at the end of the day, capabilities will have the same fate as other sandboxing mechanisms: nobody will use them. And, just so that their application works and avoid support burden, developers will tell people to use a setup that enables access to everything. pledge(2) and unveil(2) learned from the past and are way simpler. I really wish WebAssembly had adopted similar mechanisms.
    - tschneidereit 7y ago
      Agreed, and there are a lot of UX questions to sort out. Many security concepts took many attempts to figure out in full (or to the extent that they have been figured out :)) One important aspect here is that this doesn't just target whole apps. It also targets developers using dependencies: while it's desirable to restrict an application's capabilities, there's a lot of value in developers only giving packages they depend on very limited sets of capabilities. And that seems much more tractable, given that kitchen-sink packages aren't what most people want to use anyway.

vanderZwan 7y ago

I was talking with a colleague today who mentioned that he had looked at WASM for a particular use-case (file-verification IIRC) and had concluded that for now the overhead of copying memory made it run worse than well-written JavaScript. It is also my experience that the overhead of memory copying can really put a damper on performance improvements. Now, I get that sharing memory is a huge safety issue - it kind of inherently breaks the sandbox, but when I see the "nanoprocesses" bit in the article I worry about death by a thousand paper cuts (lots of tiny WASM module spending more time copying data than processing it). Are there ways/plans to minimize memory copies that don't conflict with the safety concerns?

JoshTriplett 7y ago
There will be ways to memory-map files, share memory between modules, and otherwise avoid copying memory unnecessarily. Shared memory doesn't break the sandbox. Sharing all memory by default would, but controlled sharing of specific memory doesn't. Think of it like inter-process shared memory, rather than threads sharing an entire address space.
- vanderZwan 7y ago
  Right, I was being sloppy - I guess was really thinking "memory addresses", not "memory". Anyway, that's great to hear! Any suggestions for discussions and such that one could follow to see how it develops?
- lambda 7y ago
  Reading through this, this sounds like mostly a capability based architecture, with process isolation replaced with a statically typed bytecode in which you can verify that each module can only use capabilities passed to it. I was wondering why the focus on copying memory between the processes. It should be possible to make capabilities which represent a pointer and a length (and maybe an access mode), which could be used to give a process direct access to shared memory safely. I don't know if that could be done with low enough overhead for small objects, it's possible that there would need to be a threshold below which you would just copy values to be efficient, but it seems like exploring fat pointer capabilities would be worthwhile. Memory mapping files or inter-process shared memory is the very coarse-grained version of this, using hardware protection. I feel like it should be possible to do something more efficient and finer grained with pointer capabilities and the static type checking that is done to verify WASM during compilation, but it may be a significant research project of its own.

Animats 7y ago

The primary use case for WebAssembly is malware.[1] We're probably going to regret letting WebAssembly into the browser. Because vendors won't let it be locked down so much that it can't be used for ads and tracking. Which means it has to allow malware. [1] https://www.tu-braunschweig.de/Medien-DB/ias/pubs/2019-dimva.pdf https://www.tu-braunschweig.de/Medien-DB/ias/pubs/2019-dimva...

shmolyneaux 7y ago
Thanks for the reference. Just so it's clear, the definition of "malware" used here is in-browser crypto mining and obfuscation. Only 1 in 600 of the top 1 million sites use WebAssembly. WebAssembly doesn't actually provide a new vector for malware.
- mantap 7y ago
  WebAssembly is still very immature. It unsurprising that it has such a low adoption right now. I think the real problem with webassembly would be if it becomes too popular and starts to become a JS competitor rather than a complement to JS.
  - pjmlp 7y ago
    WebAssembly is the revenge of Flash/Java/ActiveX, but this time everything will turn out perfect, as per WebAssembly advocacy.
    - DonHopkins 7y ago
      Hey don't forget Shockwave. That was the thing that totally took over the web that everybody hated before Flash.
    - mantap 7y ago
      Honestly, given the lack of tooling they have now, it is pretty much perfect from a user's perspective. You are only going to use WASM if you absolutely need the performance. It's just too painful otherwise.

deleted 7y ago

[deleted]

nabla9 7y ago

JVM was supposed to be this. Gosling said publicly that JVM is more important than Java. . Many things went wrong. Microsoft was actively sabotaging JVM. They implemented very fast JVM for Explorer and their operating system that intentionally broke the JVM 1.1 standard. See Sun vs Microsoft 1997. Microsoft lost and paid damages. .NET was created to do more damage.

jdance 7y ago
I like the JVM and have done lots of code for it, but the java download&install / setting up PATH / non native gui-look / no exe-files / should i get se/ee/jre/sdk etc etc must be a big contributing factor to its lack of being more popular (client side). A lot of the experience has been clumsy, ugly and unintuitive from the start
- pjmlp 7y ago
  WebAssembly developer experience is also not the most friendly one, with its mix of toolchains, specially if one is on Windows. Oh, and debugging is still at printf level style and reading raw bytecodes.
  - callahad 7y ago
    > debugging is still at printf level style and reading raw bytecodes Wasmtime has had support for source-level debugging via lldb or gdb for a few months https://hacks.mozilla.org/2019/09/debugging-webassembly-outside-of-the-browser/ https://hacks.mozilla.org/2019/09/debugging-webassembly-outs...
    - pjmlp 7y ago
      That doesn't look like production ready, nor integrated into browser developer tools.
- kasperni 7y ago
  Which, is also why that method for delivering applications has been deprecated for a couple of years. Now, the prefered way to ship a Java application is to bundle the runtime and the application into a single installer similar to, for example, Electron apps.

Ajedi32 7y ago

This is great. I've been waiting for a module-level permissions system for a while now; it definitely seems like the best approach to mitigate supply chain attacks. Hopefully once WASM has demonstrated the principle other languages will follow. This seems like it'd be especially useful in the JS ecosystem, where many modules are already small enough that they'd likely be able to run with no permissions at all.

stefan_ 7y ago

This is historically the kind of thing that people think is very cool and important, but has turned out to not matter at all. "Languages matter" must be the biggest enduring fallacy of computer programming. It has an obvious corollary in believing processor architectures are important.

weberc2 7y ago
It matters a whole lot. There's lots of code written in various languages and it's often prohibitive to use it in your own project because making the languages speak with each other (especially if you have performance concerns) is a lot of work. I don't expect WASM to make this trivial, but to say that it doesn't matter is patently wrong.
- gridlockd 7y ago
  I think the point is that your laundry list of features in your language of choice does not really matter when it comes to adoption. For instance, memory safety does not really matter so much that people would stop using unsafe languages.
- zzzcpan 7y ago
  Why high level languages should be able to easily speak with each other? Wouldn't this defeat the purpose of having more than one language, since they would be effectively identical?
AgentME 7y ago
The cross-language interoperability of WebAssembly seems practically like a happy side-effect of its design; I don't think it would look much differently at present if it had originally been built to target only C (in a sandboxable way). Most of the article still applies even if you ignore other language support. The first priority for WebAssembly seems to be making things strongly sandboxed.
- pjmlp 7y ago
  Actually it fails to properly sandbox C derived languages versus what hardware memory tagging like SPARC ADI and ARM are capable of, because it doesn't do bounds checks inside linear memory blocks.

Narishma 7y ago

Are those drawings supposed to be clickable? When I do so, it just opens and immediately closes a new tab or window. Firefox 70 on Windows if it makes a difference.

arendtio 7y ago
Works for me. Opens a new tab with an image, e.g.: https://2r4s9p1yi1fa2jd7j43zph8r-wpengine.netdna-ssl.com/files/2019/11/featured-image.png https://2r4s9p1yi1fa2jd7j43zph8r-wpengine.netdna-ssl.com/fil... FF 70 on Arch Linux.
- Narishma 7y ago
  That's weird. In fact it does the same with your link, though I can open it in the same tab. If I try to open it in a new tab or window, it just closes immediately.
jml7c5 7y ago
Bad adblock filter, maybe?
- Narishma 7y ago
  Yup, that was it. Disabling the ad blocker fixed this.
deleted 7y ago
[deleted]

seph-reed 7y ago

Been working with web tech since 2000... something about WASM rubs me the wrong way, at least for use in the web. It's probably the lack of human readable source code (I'm not a big fan of minified code for the same reason). If it wasn't so impossible to work with W3C, I think it would probably make more sense for the web to work towards something like more strict, compilable typescript. Then sites could download the source, compile, and cache.

Hitton 7y ago

>So how can you protect your users against these threats in today’s software ecosystem? >You could subscribe to a monitoring service that alerts you when a vulnerability is found one of your dependencies. But this only works for those that have been found. And even once a vulnerability has been found, there’s a good chance the maintainer won’t be able to fix it quickly. For example, Snyk found in the npm ecosystem that for the top 6 packages, the median time-to-fix (measured starting at the vulnerability’s inclusion) was 2.5 years. Sometimes it looks like writers think that the average reader is complete idiot. How is that supposed to be example? First they say that it takes long time fix once the bug is found and as illustration they give period starting with introduction of vulnerability?

hinkley 7y ago
We can't even get software developers to use sane metrics. Good luck getting Masters of Fine Arts people to use them property to describe software. Especially when we've provided such a stellar example.

gwbas1c 7y ago

Wait... I thought the CLR was supposed to do this? Or was it the JVM? What's old is new again!

pjmlp 7y ago
Or UNCOL, or Xerox Pilot and Dorado microcoded CPUs, or IBM z/OS and OS/400 language environments, or VMS multi-language backends, or PNaCL, or ....
- dboreham 7y ago
  You forgot the UCSD P-System.
  - pjmlp 7y ago
    It is included on the .... :)
    - DonHopkins 7y ago
      ...That reminds me of a cartoon I saw in an old Apple ][ magazine: (One kid talking to another, with dad in the background hunched over an Apple ][.) "Daddy's playing UCSD Pascal. That's the game where you try and see how many dots you can get before it beeps and you say nasty words." http://bitsavers.trailing-edge.com/pdf/ti/professional/p-system/2232399-0001_UCSD_p-System_Program_Development_Software_Library_Apr1983.pdf http://bitsavers.trailing-edge.com/pdf/ti/professional/p-sys... UCSD p-System Program Development (p. 2-4) While the compiler is running, it displays a report of its progress on the screen in this manner: Pascal compiler - release level VERSION < 0> ................... INITIALIZE < 19> ....................................... AROUTINE < 61> ....................................... < 111> ....... MYPROG < 119> ...................................... 237 lines compiled INITIALI . MYPROG .. During the first pass, the compiler displays the name of each routine. In this example, INITIALIZE, AROUTINE, and MYPROG are the routines. The numbers enclosed within angle brackets, < >, are the current line numbers and each dot on the screen represents one source line compiled.

muricula 7y ago

How can I learn more about how nanoprocesses and the wasmtime sandbox work under the hood? Searching the repo on github for common keywords doesn't turn up much. Are nanoprocesses like Windows picoprocesses somehow, or are multiple "processes" running in the same address space? If so, you can probably exfiltrate data between nanoprocesses with spectre. Additionally, if you get RCE in the wasm JIT (this happens all the time in javascript JITs), there's nothing to stop you from ropping to gadgets to open your own sockets without going through any in-process checks.

saagarjha 7y ago
> or are multiple "processes" running in the same address space Yes. > If so, you can probably exfiltrate data between nanoprocesses with spectre. Right, this is mentioned in the article. (TL;DR if this is a concern for you don’t use the sandbox, at least not until someone’s figured out how to implement timing protection.

cm2187 7y ago

Stupid question from a non specialist. I see Intel in the list of parties. Does that mean hardware acceleration for wasm?

BubRoss 7y ago
It is meant to be compiled to native instructions, I don't think there is significant room for hardware acceleration.
- cm2187 7y ago
  I am talking from a position of ignorance, but intuitively I am sure the runtime does or will do lots of things, between the sandboxing, the linking, potential garbage collection, etc.
  - BubRoss 7y ago
    It isn't run through a run time, it is meant to be just in time compiled to native instructions. There isn't any garbage collection.
JoshTriplett 7y ago
Among other things, yes; we're contributing to the SIMD support, for instance.
- markdog12 7y ago
  Anything beyond just the 128-bit SIMD yet? Last thing I seen on that was "Long SIMD" from here: https://webassembly.org/docs/future-features/ https://webassembly.org/docs/future-features/ And that was years ago. Seems like an awful waste to have many millions of cpus with avx for instance, wasted.
deleted 7y ago
[deleted]

rb808 7y ago

Can you use wasm instead of regular js/html? I'm thinking for rich GUIs it would be great, even just for company internal sites. I can't find any good examples though.

hellofunk 7y ago
Rust has libraries for this.
code_code 7y ago
I have a recent note that says (from HN id=21495338), try makepad.github.io/makepad . My recollection is that this is such an example.
- rb808 7y ago
  Nice! though confusingly its an editor that run JavaScript pages. https://makepad.github.io/makepad.html https://makepad.github.io/makepad.html
tiborsaas 7y ago
Yes, of course, you can draw anything on a regular HTML canvas and all you need is a thin layer of JS to do some interfacing. However, I'd discourage you build complex GUI-s in WA. If you do that it means that you have to reimplement everything how the browser works and your end users are accustomed to.
jedisct1 7y ago
Check out Microsoft Blazor.
- rb808 7y ago
  Actually this looks great.

FpUser 7y ago

Not in a mood of diving deep into technical details but forgive me for being skeptical. This "secure by design" execution mantra makes me somewhat sick after hearing it so many times over the decades.

lone_haxx0r 7y ago

What's the main difference between this and the Java Virtual Machine?

devwastaken 7y ago

There should not be a 'browser wasm' and a 'non browser' wasm. The wasm committee made many mistakes by treating it as an idea on paper, and not writing the actual implimenting software. This has resulted in significant fragmenting of implimentation, each less trustworthy than the last. If any software is going to advertise safety, it must prove it. That's done through the feedback cycle and careful development. The only ones that have this are in browsers. Yet browsers have their own dubious implimentation, integrated with their JavaScript environment. Unless wasm decides on a set of standard runtimes that become trustworthy there will not be a wasm outside the browser. For example, when I search for python, I get python. There's still other pythons, but there's the python. This is true of all other software used. Wasm is failing to do that.

dgellow 7y ago
Try searching for C, C++, or even SQL or Javascript. You will quickly see that you don’t have “the official implementation”, because that’s not how things work in practice when considering well standardized and widely used software.
- devwastaken 7y ago
  You're mistaking written standard for implimentation standard. You only need a standard in practice. All of those things you've listed have only a few big players, with enough use and feedback cycle that there can be multiple different implimentations. Those different implimentations are very similar. There is not a different C to compilers, they have their own quirks, benefits, and target different systems. JavaScript is the least selective of any language, you will only find runtimes for it's modern versions in browsers Typically V8 or safari. V8 has become the effective standard. SQL has multiple big implimentations that deviate completely. This has a lot to do with marketing, and the fact data storage/retrieval is a significantly diverse section of computer science. In each of these known technologies there is a well known, well backed, named software project that people use it's name synonymous with it's supposed standard. Wasm doesn't have this, and that's because the implimentations took place in browser, which afaik did not impliment a unique engine to it. It just integrates wasm instructions to their js instructions. Which then led to there being dozens of different self called 'safe' implimentations. None of these have the users, time, and open source community necessary to know this. Which will inevitably lead to exploits. Given that situation, the only way wasm is going to live up to its goal of safety is backing a well made runtime. The problem of safety is what makes this very different from other software. Your own code with bugs is an annoyance, and maybe you can't do what you wanted. But code that is meant to be safe that instead allows for damage to you, your company - that deserves a much higher level of scrutiny.

gatestone 7y ago

This is getting complicated. OS process management, threads and lightweight pocesses, green field process control, virtual machines, containers, sandboxing in n browsers with m different technologies, now this WASM stuff..and orchestrating this all across the cloud and the global internet, ending in homes and corporate machine rooms. Enverywhere you have to think: who can load/run a module/process and from where, how to authenticate and authorize, which API to give to it, etc... A historical note: Bell Labs Plan 9 had a universal OS level solution, that Linux has somewhat adopted, but could not make general enough, partly due to the higher lever ecosystem being stuck to old ways: - per process name spaces with mountable/inheritable/stackable union directories and optionally sharebale memory (Linux light-weight process, LWP, comes close, it was also historically copied from Plan 9) - Almosty all APIs (even "system calls") as synthetic file systems (Where do you think /proc came from?) - which you could mount and access (efficiently) locally or through a secure unified network protocol (9P) On Plan 9 you could just run different parts of the browser (JavaScript engine, WASM or anything) in a tailored limited LWP with limited mounts as synthetic file system APIs... Note that Docker kind of retro-fits Plan 9 ideas in Linux kernel to embrace and extend the original ideas of Plan 9...

wahern 7y ago
> Where do you think /proc came from? UNIX 8th Edition (http://lucasvr.gobolinux.org/etc/Killian84-Procfs-USENIX.pdf http://lucasvr.gobolinux.org/etc/Killian84-Procfs-USENIX.pdf) and SRV4 (https://www.usenix.org/sites/default/files/usenix_winter91_faulkner.pdf https://www.usenix.org/sites/default/files/usenix_winter91_f...) A better analogy would be /dev, but that was already part of Unix from the beginning. Plan 9 is really about per process, user mountable namespaces implemented by 9P-speaking user processes; basically what you said, sans the origin of synthetic file systems and file-like objects.

jeltz 7y ago

One pretty annoying thing with WASM is that it is pretty hard to generate due to requiring a structured control flow so anyone generating it must implement relooper och stackifier. Is there any work on solving this issue? http://troubles.md/posts/why-do-we-need-the-relooper-algorithm-again/ http://troubles.md/posts/why-do-we-need-the-relooper-algorit...