4 ms·

sounds like java's SecurityManager all over again

samus 5y ago
Java's security manager blocks access to existing APIs that are already linked. The new approach relies on explicitly making only specific APIs available.
colordrops 5y ago
Except you can run JS and C++ in it and the VM is already on every machine on earth.
- kaba0 5y ago
  Which GraalVM can do much better as well, even optimizing through language boundaries (it can effectively inline a C FFI call into whatever language made that)
  - emteycz 5y ago
    My work computer has no GraalVM but it has two Wasm runtimes without needing to consult the IT department. Graal is cool tech but it's not playing the same game Wasm is.
    - kaba0 5y ago
      How is that relevant? Like, if there is a need for it than the IT department will install Graal. Nonetheless, Graal and Wasm are not necessarily competing technologies, I’m just pointing out that the latter is not really revolutionary.
      - emteycz 5y ago
        The point is, I think there will almost never be a need to install Graal when there is Wasm already present and used by most apps. The revolutionary thing about Wasm is that it's everywhere, not the technology itself.
asddubs 5y ago
or like bsds pledge
- majewsky 5y ago
  This is on a different level than pledge. pledge applies to the whole process. This sandboxing, as far as I understand, would restrict syscall access to individual functions and modules inside a process.
  - Chris2048 5y ago
    Can pledge apply to child/sub-processes only?
naasking 5y ago
Nothing could be further than the truth. Capability-secure Java code just looks like Java with no surprises. The only difference is that ambient authority has been removed, which means that no code can just call new File("some_file.txt") and amplify a string that conveys no permissions into a file object conveying loads of permissions, you have to be explicitly given a Directory object that already conveys permission to a specific directory, and on which you call directory.createFile("some_file.txt") Just remove the rights amplification anti-pattern and programs instantly become more secure.

Java's security manager blocks access to existing APIs that are already linked. The new approach relies on explicitly making only specific APIs available.

colordrops 5y ago

Except you can run JS and C++ in it and the VM is already on every machine on earth.

kaba0 5y ago
Which GraalVM can do much better as well, even optimizing through language boundaries (it can effectively inline a C FFI call into whatever language made that)
- emteycz 5y ago
  My work computer has no GraalVM but it has two Wasm runtimes without needing to consult the IT department. Graal is cool tech but it's not playing the same game Wasm is.
  - kaba0 5y ago
    How is that relevant? Like, if there is a need for it than the IT department will install Graal. Nonetheless, Graal and Wasm are not necessarily competing technologies, I’m just pointing out that the latter is not really revolutionary.
    - emteycz 5y ago
      The point is, I think there will almost never be a need to install Graal when there is Wasm already present and used by most apps. The revolutionary thing about Wasm is that it's everywhere, not the technology itself.

asddubs 5y ago

or like bsds pledge

majewsky 5y ago
This is on a different level than pledge. pledge applies to the whole process. This sandboxing, as far as I understand, would restrict syscall access to individual functions and modules inside a process.
- Chris2048 5y ago
  Can pledge apply to child/sub-processes only?

naasking 5y ago

Nothing could be further than the truth. Capability-secure Java code just looks like Java with no surprises. The only difference is that ambient authority has been removed, which means that no code can just call new File("some_file.txt") and amplify a string that conveys no permissions into a file object conveying loads of permissions, you have to be explicitly given a Directory object that already conveys permission to a specific directory, and on which you call directory.createFile("some_file.txt") Just remove the rights amplification anti-pattern and programs instantly become more secure.