7 ms·

WASI: A New Kind of System Interface

99 points by lewisjoe 5y ago

bigcat123 5y ago
https://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html https://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-... Case in comparison, bpf or ebpf. In that they are both a type of radically different approach on solving the old problem. Bpf being kernel programmability for app developer, wasm being portable execution environment.
mikewarot 5y ago
Virtualization, then Containers, and now WASM are all stages in completing the implementation of capability based security started long ago with the separation of root and users back in Unix. While it is reasonable to trust users with their own files, it is unreasonable that the only model of computing offered to those users requires that they then give all of their privileges to every piece of code they run. It is possible to run code from anywhere without having to trust it, thanks to this new model of computing.
- naasking 5y ago
  > It is possible to run code from anywhere without having to trust it, thanks to this new model of computing. Capability security is almost as old as access control lists. That's the only quibble I have with your post.
  - mikewarot 5y ago
    >Capability security is almost as old as access control lists. Yes, but it's never been fully implemented. Separating superuser/root from normal users was a good first approximation. However, in the modern era of persistent internet and mobile code, we need to finish the job. Theoretically, you could start a new process having previously created a new UID and having turned off access to all files in the ACL on the root, but can a user do that? Easily? Can you explain it to someone's mom? Money in a wallet is capability based, and people have managed that model since the beginning. I'm fine with ACLs for managing overall access to file structures on a per account basis, they don't work for a per execution instance basis.
    - zozbot234 5y ago
      Aren't UID's namespaced in modern Linux? It should be quite possible.
    - naasking 5y ago
      > Yes, but it's never been fully implemented. Separating superuser/root from normal users was a good first approximation It sure has, in at least 6 different operating systems that have actually seen real world use, and 3 programming languages since the mid 70s.
      - infogulch 5y ago
        > Can you explain it to someone's mom?
        speed_spread 5y ago
        "Don't click the Incredimail links in your email"
        naasking 5y ago
        Actually, under capability security it should be pretty safe to click links in emails, because all programs that run with least possible privilege. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
- RodgerTheGreat 5y ago
  It's a good thing there aren't any known classes of architectural attacks exploiting the interaction of speculative execution and caches to exfiltrate sensitive data, nor are there classes of attacks which exploit the physical properties of DRAM to evade memory protection. Yes indeed; running untrusted code blobs on my home computers and cloud servers alike is truly and finally solved by running them in a VM.
  - abtinf 5y ago
    Malicious attacks aren't always the vector of concern. There are many software packages that confine themselves to what is legal. They often want to ingest and upload everything they can about the user. But if they are locked down to a narrow set of user data, they won't risk the liability of attacking the protections themselves.
    - thfuran 5y ago
      It's also rather harder to exfiltrate data via rowhammer or meltdown than via, say, unrestricted filesystem access so even if it's technically possible, it will be less prevalent.
  - mikewarot 5y ago
    I agree that we have big problem with defective CPUs and DRAM in the industry. Those chips and modules shouldn't have made it out the factory door, nor should they have passed quality control at the receiving desk. We also seem to have the same issue with SSD modules and SYNC commands. You can't fix broken hardware in software without taking a huge performance it, if it is possible at all. Yes, we all like to point out corner cases here, don't we?
- deleted 5y ago
  [deleted]
- gumby 5y ago
  > all stages in completing the implementation of capability based security started long ago with the separation of root and users back in Unix. Ahem, such distinction predates Unix, and in fact Unix has a watered down regime compared to Multics, which implemented a multiple ring approach. In other words, computing existed before Unix.
- pjmlp 5y ago
  Burroughs was one of the first computing systems usign bytecode as executable format and capability based security, it is 10 years older than UNIX. Its security capabilities are one of the reasons why Unisys keeps updating and selling it to customers that want security above everything else. Virtualization and containers have existed in IBM mainframes for a decade before making their way into UNIX.
Starlevel001 5y ago
1994 blog post: "java.lang: A New Kind Of System Interface"
- IshKebab 5y ago
  Yeah it worked well if you were ok with writing code in Java. Guess what? Lots of people don't want to write Java. WASI lets you use lots of languages included non-GC languages (GC'd languages are a bit of a WIP but it's going to happen).
  - Starlevel001 5y ago
    > Guess what? Lots of people don't want to write Java. It's funny that some of the most popular languages these days are Go (crippled Java 1.4) and Rust (Java for frontend web developers who need to be tricked into it) so it seems like lots of people really do want to write Java.
    - IshKebab 5y ago
      That's such a weird thing to say. Go and Rust are both very different to Java.
  - gorjusborg 5y ago
    You didn't need to write java to use the JVM, but okay.
  - pjmlp 5y ago
    Just like Amsterdam Compiler Kit or IBM TIMI, as two examples among many others for bytecode used by non-GC languages.
- etaioinshrdlu 5y ago
  I'm also slightly annoyed nowadays by "A New Kind of X" simply because of Wolfram's self-aggrandizing book A New Kind of Science.
- panick21_ 5y ago
rileyphone 5y ago
Maybe it's by design, but my biggest sticking point with WASM is the inability to modify the code at runtime, at least to my knowledge. This makes it a bad target for dynamic languages where the source -> executable mapping isn't wholly known ahead of time, especially Lisps but also any looking to JIT compile things. Speaking of Lisp and WASM, IchigoLisp [0] is a remarkably faithful implementation of LISP 1.5 in WAT. Extraordinarily impressive, and inspires even more awe for the original system from the 60s. [0] https://github.com/zick/IchigoLisp https://github.com/zick/IchigoLisp
- hmry 5y ago
  Well, that functionality is not included by default, but you can certainly add it yourself. Add a function to your host system (be it a browser, a CLI interpreter, etc) which accepts a wasm module you dynamically create, instantates it, and gives you acces to some function it exports. I don't think any WASM implementations provide such a function by default, but that can be changed easily and is not an insurmountable limitation of WASM.
- Skinney 5y ago
  I believe you can call functions through a table, which makes it trivial to switch out functions at runtime.
- VikingCoder 5y ago
  Well, you can always add a VM inside WASM as a layer of abstraction, and modify its code at runtime. Is that what things like this [1] are doing? [1] https://github.com/pyodide/pyodide https://github.com/pyodide/pyodide
- emteycz 5y ago
  It's still possible to JIT Wasm code and run it, though. WebVM does that.
VikingCoder 5y ago
The second part of the talk is close to what I want, but they're missing a few parts. I want to set up a DNS-like system, where I have some pub/private key pair to control which servers you can find me at. My friend Tom sets his up, too. Then I want to tell the Service Host she's talking about, "Here's my friend Tom's public key. Please look him up in the DNS system, and find out how to reach one of his hosts. Let this new Service X, talk to Tom. Use something like Wire Guard to establish a connection directly from this wasm Service X that I'm running, to a similar wasm service X that Tom is running. We're going to send proto messages (not streams!) back and forth to each other, and you're in charge of connectivity." Give me that, and the ability to talk to, I dunno, Redis, SQLite, MongoDB, and/or maybe Firebase, and I think people could make some really amazing federated or P2P social apps with a very, very small amount of code. I picture writing a Front-end UI on Flutter that talks to a Back-end like I describe. PS maybe someone could make a WASM-first (no Dart) version of Flutter?
- lifty 5y ago
  You can achieve that using Handshake, which is a blockchain based replacement for DNS + PKI.
- zcw100 5y ago
  Or you could use IPFS with P2PConnect where you can look them up by public key and completely skip DNS.
- tedunangst 5y ago
  This seems like a not that complicated library on top of what fundamentals actually need to be built.
- wahern 5y ago
  Most of this is feasible today using Opportunistic IPSec. What's missing is the high-level (Redis, SQLite, MongoDB, etc) application interfaces you're hinting at. Opportunistic IPSec operates at the IP layer, below all of that. There are BSD socket API controls for IPSec, but Opportunistic IPSec was mostly intended to be passive except for an application (optionally) requesting or verifying that a data stream is protected. Unfortunately, Opportunistic IPSec failed miserably at widespread adoption. The same fate is almost certainly waiting for any similar all-encompassing approach. Wireguard doesn't really help as the vast majority of the complexity and pain exists above the level of the basic stream encryption. (Supporting schemes like Opportunistic IPSec is one reason why IPSec permits direct IP-to-IP encryption without tunneling or layering. One of Wireguard's simplifying assumptions was that it would be used to create VPNs and tunnels; TLS had won the day as a solution for direct, end-to-end encryption.)
pontifier 5y ago
I'm 10 minutes in, and thinking "So you want more programs to read from standard input?"
- hansel_der 5y ago
  yea, programs that cannot work with stdin better have a very good reason for it.

99 points by lewisjoe 5y ago

https://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html https://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-... Case in comparison, bpf or ebpf. In that they are both a type of radically different approach on solving the old problem. Bpf being kernel programmability for app developer, wasm being portable execution environment.

mikewarot 5y ago

Virtualization, then Containers, and now WASM are all stages in completing the implementation of capability based security started long ago with the separation of root and users back in Unix. While it is reasonable to trust users with their own files, it is unreasonable that the only model of computing offered to those users requires that they then give all of their privileges to every piece of code they run. It is possible to run code from anywhere without having to trust it, thanks to this new model of computing.

naasking 5y ago
> It is possible to run code from anywhere without having to trust it, thanks to this new model of computing. Capability security is almost as old as access control lists. That's the only quibble I have with your post.
- mikewarot 5y ago
  >Capability security is almost as old as access control lists. Yes, but it's never been fully implemented. Separating superuser/root from normal users was a good first approximation. However, in the modern era of persistent internet and mobile code, we need to finish the job. Theoretically, you could start a new process having previously created a new UID and having turned off access to all files in the ACL on the root, but can a user do that? Easily? Can you explain it to someone's mom? Money in a wallet is capability based, and people have managed that model since the beginning. I'm fine with ACLs for managing overall access to file structures on a per account basis, they don't work for a per execution instance basis.
  - zozbot234 5y ago
    Aren't UID's namespaced in modern Linux? It should be quite possible.
  - naasking 5y ago
    > Yes, but it's never been fully implemented. Separating superuser/root from normal users was a good first approximation It sure has, in at least 6 different operating systems that have actually seen real world use, and 3 programming languages since the mid 70s.
    - infogulch 5y ago
      > Can you explain it to someone's mom?
      - speed_spread 5y ago
        "Don't click the Incredimail links in your email"
        naasking 5y ago
        Actually, under capability security it should be pretty safe to click links in emails, because all programs that run with least possible privilege. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
RodgerTheGreat 5y ago
It's a good thing there aren't any known classes of architectural attacks exploiting the interaction of speculative execution and caches to exfiltrate sensitive data, nor are there classes of attacks which exploit the physical properties of DRAM to evade memory protection. Yes indeed; running untrusted code blobs on my home computers and cloud servers alike is truly and finally solved by running them in a VM.
- abtinf 5y ago
  Malicious attacks aren't always the vector of concern. There are many software packages that confine themselves to what is legal. They often want to ingest and upload everything they can about the user. But if they are locked down to a narrow set of user data, they won't risk the liability of attacking the protections themselves.
  - thfuran 5y ago
    It's also rather harder to exfiltrate data via rowhammer or meltdown than via, say, unrestricted filesystem access so even if it's technically possible, it will be less prevalent.
- mikewarot 5y ago
  I agree that we have big problem with defective CPUs and DRAM in the industry. Those chips and modules shouldn't have made it out the factory door, nor should they have passed quality control at the receiving desk. We also seem to have the same issue with SSD modules and SYNC commands. You can't fix broken hardware in software without taking a huge performance it, if it is possible at all. Yes, we all like to point out corner cases here, don't we?
deleted 5y ago
[deleted]
gumby 5y ago
> all stages in completing the implementation of capability based security started long ago with the separation of root and users back in Unix. Ahem, such distinction predates Unix, and in fact Unix has a watered down regime compared to Multics, which implemented a multiple ring approach. In other words, computing existed before Unix.
pjmlp 5y ago
Burroughs was one of the first computing systems usign bytecode as executable format and capability based security, it is 10 years older than UNIX. Its security capabilities are one of the reasons why Unisys keeps updating and selling it to customers that want security above everything else. Virtualization and containers have existed in IBM mainframes for a decade before making their way into UNIX.

Starlevel001 5y ago

1994 blog post: "java.lang: A New Kind Of System Interface"

IshKebab 5y ago
Yeah it worked well if you were ok with writing code in Java. Guess what? Lots of people don't want to write Java. WASI lets you use lots of languages included non-GC languages (GC'd languages are a bit of a WIP but it's going to happen).
- Starlevel001 5y ago
  > Guess what? Lots of people don't want to write Java. It's funny that some of the most popular languages these days are Go (crippled Java 1.4) and Rust (Java for frontend web developers who need to be tricked into it) so it seems like lots of people really do want to write Java.
  - IshKebab 5y ago
    That's such a weird thing to say. Go and Rust are both very different to Java.
- gorjusborg 5y ago
  You didn't need to write java to use the JVM, but okay.
- pjmlp 5y ago
  Just like Amsterdam Compiler Kit or IBM TIMI, as two examples among many others for bytecode used by non-GC languages.
etaioinshrdlu 5y ago
I'm also slightly annoyed nowadays by "A New Kind of X" simply because of Wolfram's self-aggrandizing book A New Kind of Science.
panick21_ 5y ago

rileyphone 5y ago

Maybe it's by design, but my biggest sticking point with WASM is the inability to modify the code at runtime, at least to my knowledge. This makes it a bad target for dynamic languages where the source -> executable mapping isn't wholly known ahead of time, especially Lisps but also any looking to JIT compile things. Speaking of Lisp and WASM, IchigoLisp [0] is a remarkably faithful implementation of LISP 1.5 in WAT. Extraordinarily impressive, and inspires even more awe for the original system from the 60s. [0] https://github.com/zick/IchigoLisp https://github.com/zick/IchigoLisp

hmry 5y ago
Well, that functionality is not included by default, but you can certainly add it yourself. Add a function to your host system (be it a browser, a CLI interpreter, etc) which accepts a wasm module you dynamically create, instantates it, and gives you acces to some function it exports. I don't think any WASM implementations provide such a function by default, but that can be changed easily and is not an insurmountable limitation of WASM.
Skinney 5y ago
I believe you can call functions through a table, which makes it trivial to switch out functions at runtime.
VikingCoder 5y ago
Well, you can always add a VM inside WASM as a layer of abstraction, and modify its code at runtime. Is that what things like this [1] are doing? [1] https://github.com/pyodide/pyodide https://github.com/pyodide/pyodide
emteycz 5y ago
It's still possible to JIT Wasm code and run it, though. WebVM does that.

VikingCoder 5y ago

The second part of the talk is close to what I want, but they're missing a few parts. I want to set up a DNS-like system, where I have some pub/private key pair to control which servers you can find me at. My friend Tom sets his up, too. Then I want to tell the Service Host she's talking about, "Here's my friend Tom's public key. Please look him up in the DNS system, and find out how to reach one of his hosts. Let this new Service X, talk to Tom. Use something like Wire Guard to establish a connection directly from this wasm Service X that I'm running, to a similar wasm service X that Tom is running. We're going to send proto messages (not streams!) back and forth to each other, and you're in charge of connectivity." Give me that, and the ability to talk to, I dunno, Redis, SQLite, MongoDB, and/or maybe Firebase, and I think people could make some really amazing federated or P2P social apps with a very, very small amount of code. I picture writing a Front-end UI on Flutter that talks to a Back-end like I describe. PS maybe someone could make a WASM-first (no Dart) version of Flutter?

lifty 5y ago
You can achieve that using Handshake, which is a blockchain based replacement for DNS + PKI.
zcw100 5y ago
Or you could use IPFS with P2PConnect where you can look them up by public key and completely skip DNS.
tedunangst 5y ago
This seems like a not that complicated library on top of what fundamentals actually need to be built.
wahern 5y ago
Most of this is feasible today using Opportunistic IPSec. What's missing is the high-level (Redis, SQLite, MongoDB, etc) application interfaces you're hinting at. Opportunistic IPSec operates at the IP layer, below all of that. There are BSD socket API controls for IPSec, but Opportunistic IPSec was mostly intended to be passive except for an application (optionally) requesting or verifying that a data stream is protected. Unfortunately, Opportunistic IPSec failed miserably at widespread adoption. The same fate is almost certainly waiting for any similar all-encompassing approach. Wireguard doesn't really help as the vast majority of the complexity and pain exists above the level of the basic stream encryption. (Supporting schemes like Opportunistic IPSec is one reason why IPSec permits direct IP-to-IP encryption without tunneling or layering. One of Wireguard's simplifying assumptions was that it would be used to create VPNs and tunnels; TLS had won the day as a solution for direct, end-to-end encryption.)

pontifier 5y ago

I'm 10 minutes in, and thinking "So you want more programs to read from standard input?"

hansel_der 5y ago
yea, programs that cannot work with stdin better have a very good reason for it.