3 ms·
Use NaCL or other SFI techniques. It doesn't require any kind of serialization/deserialization code, contrary to your suggestion. Here's the original SFI paper,
by catern 5y ago
Use NaCL or other SFI techniques. It doesn't require any kind of serialization/deserialization code, contrary to your suggestion. Here's the original SFI paper, maybe it's more approachable? https://cs155.stanford.edu/papers/sfi.pdf https://cs155.stanford.edu/papers/sfi.pdf
- theamk 5y agoI feel like you re not hearing my question -- I asked, "I have a modern app written in C or Python,[...] what are my options" and you are telling me to use NaCl, with last stable release in 2015. Even if NaCl was a good option (it was not), it is still discontinued. So let me ask again, are there any modern options for library isolation, something I can actually download and link to a C program? Something with github page I can visit and download the code, and a community that can support/answer questions? And if such thing exists, is this easier to use than your favorite IPC system? ----- Re NaCl: NaCL definitely requires some kind kind of serialization/deserialization code. The paper [0] is pretty clear that NaCl-isolated code lives in a separate process (see Figure 1, and section 2) and can only communicate over IMC, which uses "datagrams consisting of untyped byte arrays along with optional NaCl Resource Descriptors”. And you need serialization to send over untyped byte arrays. Moreover, at the end of section 2, the paper says: "It is not appropriate for modules requiring process creation, direct file system access, or unrestricted access to the network"... which rules out a lot of the interesting libraries. [0] https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/34913.pdf https://static.googleusercontent.com/media/research.google.c...