3 ms·

WASM only provides sandboxing. That is not the same as security nor it means runtime safety nor protection from undefined behavior.

by rini17 6y ago

MaxBarraclough 6y ago
> WASM only provides sandboxing. That is not the same as security The relevant Wikipedia article is named Sandbox (computer security). > nor it means runtime safety nor protection from undefined behavior It puts stronger constraints on what mischief undefined behaviour can lead to, and guarantees that various runtime errors are handled with traps. [0] This isn't the same as a hard guarantee that execution will terminate whenever undefined behaviour is invoked, but it's still a step up. [0] https://webassembly.org/docs/security/ https://webassembly.org/docs/security/
- ssokolow 6y ago
  Speaking as someone who would love to see WebAssembly succeed as a cross-platform, cross-language way for me to write sandboxed plugins and CLI utilities, I do have to point out that, for out-of-browser use, WASM's MVP does regress various things: * https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-languages-safe/ https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-la... * https://www.usenix.org/system/files/sec20-lehmann.pdf https://www.usenix.org/system/files/sec20-lehmann.pdf (eg. Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault.)
  - MaxBarraclough 6y ago
    > Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault. Thanks that's a curious one. It won't always lead to a segfault with a conventional compiler either, undefined behaviour being what it is. [0][1] Fortunately GCC can be asked to add such checks at runtime, [2] this approach could also be taken with WebAssembly. [0] https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=633 https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=63... [1] https://blog.regehr.org/archives/213 https://blog.regehr.org/archives/213 [2] https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.h...
    - ssokolow 6y ago
      I was more referring to how it's standard practice on modern OSes to leave the zero page unmapped in a process's address space so that, if the compiler converts the NULL dereference into a dereference of address 0x0, it'll trigger a segfault.

WASM only provides sandboxing. That is not the same as security nor it means runtime safety nor protection from undefined behavior.

by rini17 6y ago

WASM only provides sandboxing. That is not the same as security nor it means runtime safety nor protection from undefined behavior.

MaxBarraclough 6y ago

> WASM only provides sandboxing. That is not the same as security The relevant Wikipedia article is named Sandbox (computer security). > nor it means runtime safety nor protection from undefined behavior It puts stronger constraints on what mischief undefined behaviour can lead to, and guarantees that various runtime errors are handled with traps. [0] This isn't the same as a hard guarantee that execution will terminate whenever undefined behaviour is invoked, but it's still a step up. [0] https://webassembly.org/docs/security/ https://webassembly.org/docs/security/

ssokolow 6y ago
Speaking as someone who would love to see WebAssembly succeed as a cross-platform, cross-language way for me to write sandboxed plugins and CLI utilities, I do have to point out that, for out-of-browser use, WASM's MVP does regress various things: * https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-languages-safe/ https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-la... * https://www.usenix.org/system/files/sec20-lehmann.pdf https://www.usenix.org/system/files/sec20-lehmann.pdf (eg. Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault.)
- MaxBarraclough 6y ago
  > Under WebAssembly's memory model, dereferencing NULL=0 won't lead to a segfault. Thanks that's a curious one. It won't always lead to a segfault with a conventional compiler either, undefined behaviour being what it is. [0][1] Fortunately GCC can be asked to add such checks at runtime, [2] this approach could also be taken with WebAssembly. [0] https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=633 https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=63... [1] https://blog.regehr.org/archives/213 https://blog.regehr.org/archives/213 [2] https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.h...
  - ssokolow 6y ago
    I was more referring to how it's standard practice on modern OSes to leave the zero page unmapped in a process's address space so that, if the compiler converts the NULL dereference into a dereference of address 0x0, it'll trigger a segfault.