5 ms·
It means you can port existing native apps to WASM more easily. You could use the WALI layer to narrow down your syscalls and what they're allowed to do in a gr
by striking 3y ago
It means you can port existing native apps to WASM more easily. You could use the WALI layer to narrow down your syscalls and what they're allowed to do in a gradual way, without having to write your own WASM engine from scratch. The way they phrase it is, they're "decoupling feature completeness from the security model and pushing API implementations outside the trusted computing base (TCB) of the engine", and I think that's a reasonable approach given that there are other reasons to port to WASM (independence from processor architecture, lightweight in-memory sandboxing esp. of potentially untrusted code, restrictions on the way control flow can be manipulated, etc.)
WASI is what provides the capability-based security model, WASM is just a binary format. Nothing wrong with having a different way of interpreting WASM, is there?
- sheepscreek 3y agoI am starting to think of WASM as an ambitious language agnostic VM and ecosystem. It is like the JVM standard - but for any language. And as the runtimes exist for most platforms, anything compiled to WASM is automatically cross-platform. Also, it is designed for better security (to run inside a browser sandbox). No GC by default but that may change with WasmGC. You can use it with Docker using the WASM backend. Who knows, maybe one day all operating systems will have native WASN support. Then it will truly become the ubiquitous/universal binary format!!
- pjmlp 3y ago> It is like the JVM standard - but for any language. Just like CLR in 2001, or TIMI in 1988, among several others, then again learning about history of computing isn't a strong concern in our field.
- PH95VuimJjqBqy 3y agoI expect OS vendors to start shipping their own WASM infra that allows controlled access to local resources.
- mikewarot 3y agoAt which point, WASM becomes worthless as a secure environment in which to run portable code downloaded at random from the internet.
- PH95VuimJjqBqy 3y agooh yeah, hey gais, if you could use the native gui tookit suddenly it being in a sandbox is worthless! stop with the hyperbole.