4 ms·

So for someone who has python installed locally, what's the point? Is it just the sandbox or is there anything else I'm missing?

by c120 4y ago

chc 4y ago
If you're just looking to run trusted scripts locally, there isn't much point. If you're running a system that uses wasm, this means you can now easily support Python.
kasajian 4y ago
It's not for someone who only runs Python locally.
angelmm 4y ago
You get an extra layer of isolation, even at your development environment level. I remember a NodeJs CVE that was caused by a poisoned dependency. It was affecting people when downloading it from npm. There’s still a gap here to cover, but the benefits may be worth :)
- ElectricalUnion 4y ago
  I don't see how this would in any way prevent you from being affected by a equivalent poisoned pypi dependency; after all your secrets/credentials are inside the sandbox anyways or your code can't work.
  - angelmm 4y ago
    With Wasm + WASI, you need to explicitly mount files and environment variables. Inside the Wasm VM, the Python interpreter, source code and dependencies only have access to a very reduced surface. Although you're right that if you mount credentials inside, they will be accessible too. The incident I was talking about was the event-stream[1] vulnerability. The attacker introduced code that looked for the data of a crypto wallet. This data was stored in the user's home. By default, interpreters may get access to the same resources that the user running the process. In Wasm, the resources are granted manually. [1] https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident https://blog.npmjs.org/post/180565383195/details-about-the-e...
    - still_grokking 4y ago
      > By default, interpreters may get access to the same resources that the user running the process. In Wasm, the resources are granted manually. What's the difference to run the code under a different user (like for example `nobody` for "full sandboxing", or a "clone of nobody" with some additional access rights)?
      - simonw 4y ago
        Running code under a different user is hard. I don't know how I would do that on macOS, and the times I've done it on Linux I've always had to jump through a bunch of hoops.
        still_grokking 4y ago
        MacOS aside, as this is not a serous operating system for this kind of workloads, do you think the "hoops" (which actually?) one needs to "jump through" are so problematic that it makes sense to create millions of lines of new code just to work around them? Only to arrive at the same result that is already working since something around 50 years? This must be really grave issues with just running a task as a different user… Could you expand on that?
        simonw 4y ago
        I want to write software that end users can install on their own machines, that supports plugins so they can execute additional code from untrusted sources. So macOS needs to work. Microsoft Flight Simulator uses WebAssembly for its extensions system. I want to do the same thing for my own projects.

So for someone who has python installed locally, what's the point? Is it just the sandbox or is there anything else I'm missing?

by c120 4y ago

So for someone who has python installed locally, what's the point? Is it just the sandbox or is there anything else I'm missing?

chc 4y ago

If you're just looking to run trusted scripts locally, there isn't much point. If you're running a system that uses wasm, this means you can now easily support Python.

kasajian 4y ago

It's not for someone who only runs Python locally.

angelmm 4y ago

You get an extra layer of isolation, even at your development environment level. I remember a NodeJs CVE that was caused by a poisoned dependency. It was affecting people when downloading it from npm. There’s still a gap here to cover, but the benefits may be worth :)

ElectricalUnion 4y ago
I don't see how this would in any way prevent you from being affected by a equivalent poisoned pypi dependency; after all your secrets/credentials are inside the sandbox anyways or your code can't work.
- angelmm 4y ago
  With Wasm + WASI, you need to explicitly mount files and environment variables. Inside the Wasm VM, the Python interpreter, source code and dependencies only have access to a very reduced surface. Although you're right that if you mount credentials inside, they will be accessible too. The incident I was talking about was the event-stream[1] vulnerability. The attacker introduced code that looked for the data of a crypto wallet. This data was stored in the user's home. By default, interpreters may get access to the same resources that the user running the process. In Wasm, the resources are granted manually. [1] https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident https://blog.npmjs.org/post/180565383195/details-about-the-e...
  - still_grokking 4y ago
    > By default, interpreters may get access to the same resources that the user running the process. In Wasm, the resources are granted manually. What's the difference to run the code under a different user (like for example `nobody` for "full sandboxing", or a "clone of nobody" with some additional access rights)?
    - simonw 4y ago
      Running code under a different user is hard. I don't know how I would do that on macOS, and the times I've done it on Linux I've always had to jump through a bunch of hoops.
      - still_grokking 4y ago
        MacOS aside, as this is not a serous operating system for this kind of workloads, do you think the "hoops" (which actually?) one needs to "jump through" are so problematic that it makes sense to create millions of lines of new code just to work around them? Only to arrive at the same result that is already working since something around 50 years? This must be really grave issues with just running a task as a different user… Could you expand on that?
        simonw 4y ago
        I want to write software that end users can install on their own machines, that supports plugins so they can execute additional code from untrusted sources. So macOS needs to work. Microsoft Flight Simulator uses WebAssembly for its extensions system. I want to do the same thing for my own projects.