4 ms·

Obviously this also needs to be a library in Zig, Rust, Go, Elixir, Haskell, Java, C#, F#, OCaml, PHP, Python, Ruby, Perl, C, C++ & Lean So, it now lives as an

Obviously this also needs to be a library in Zig, Rust, Go, Elixir, Haskell, Java, C#, F#, OCaml, PHP, Python, Ruby, Perl, C, C++ & Lean So, it now lives as an Extism[0] wasm plugin you can call from those languages: https://modsurfer.dylibso.com/module?hash=2050e7f7a129a48df08a231411135711dc87a33c81367493836ca68834c02907 https://modsurfer.dylibso.com/module?hash=2050e7f7a129a48df0... [0]: https://github.com/extism/extism https://github.com/extism/extism

mnahkies 3y ago
Interesting, I hadn't come across extism before. How hard would it be to package https://github.com/biojppm/rapidyaml https://github.com/biojppm/rapidyaml in this way? (And do you have a extism for dummies guide?)
- nilslice 3y ago
  Extism can be really useful for packaging up and running cross-language libraries! The most clear information about it is at: https://extism.org https://extism.org, but its a bit focused on the primary use case for Extism, being a universal plugin system. There is a C PDK (https://github.com/extism/c-pdk https://github.com/extism/c-pdk) which you'd probably want to use in a new wrapper around your library in C++, and compile it to wasm32 freestanding or WASI, but without emscripten. Extism doesn't currently have an interop layer to emscripten.
  - richardfey 3y ago
    > Don't worry about what some plug-in code might do to your program. Extism is built with security as a core principle, and fully sandboxes the execution of all plug-in code. I find the wording a bit off here. Responsible security involves transparency along the supply chain and minimum trust, certainly not talking about worries and giving them up with ease.
    - nilslice 3y ago
      Would you suggest something more appropriate?
      - richardfey 3y ago
        I do not know Extism, but I would start from the process of verifying the security of it, and highlight what allows to check it quickly and with certainty. For example documentation of the sandbox and possibility to inspect all syscalls performed with verbose logging. These are just examples; basically I would put focus on minimal trust and maximum transparency.
      - richardfey 3y ago
        Note: there can always be problems of data exfiltration or compute power theft (as part of a botnet or mining), so owning the machine is not the only risk to mitigate.
        nilslice 3y ago
        Both great points! Extism docs assume some level of familiarity with the security model of WebAssembly. Which unless you grant it granular permission, does mitigate the risks you’ve mentioned. I agree we should do more to specifically call out these security benefits - and also how a user could impact that default security.
foundart 3y ago
This is the first I've heard of Extism. I like their goal! "Extism's goal is to make all software programmable." [0] [0] https://extism.org/docs/overview https://extism.org/docs/overview
- nilslice 3y ago
  hey thank you! we are trying to make that a reality :)
crubier 3y ago
Woah Extism is exactly what I need for a project where I want a plugin system, nice random find, thank you! Question: Does extism plan to support Python as a plugin language? That seems like a big gap right now Edit: I see this issue tracking it https://github.com/extism/extism/issues/116 https://github.com/extism/extism/issues/116 and the project is ongoing https://github.com/extism/python-pdk/issues/2 https://github.com/extism/python-pdk/issues/2
- nilslice 3y ago
  Yes, we would love to add a Python PDK - and as you discovered have one that is very close. Python is pretty tricky given most users want libraries with native/C dependencies. With those and the Python runtime, the wasm tends to bloat up to tens of MB, rather unideal for a plug-in. If you have time, please comment on that issue though and share some thoughts or use cases so we can better prioritize support!

mnahkies 3y ago

Interesting, I hadn't come across extism before. How hard would it be to package https://github.com/biojppm/rapidyaml https://github.com/biojppm/rapidyaml in this way? (And do you have a extism for dummies guide?)

nilslice 3y ago
Extism can be really useful for packaging up and running cross-language libraries! The most clear information about it is at: https://extism.org https://extism.org, but its a bit focused on the primary use case for Extism, being a universal plugin system. There is a C PDK (https://github.com/extism/c-pdk https://github.com/extism/c-pdk) which you'd probably want to use in a new wrapper around your library in C++, and compile it to wasm32 freestanding or WASI, but without emscripten. Extism doesn't currently have an interop layer to emscripten.
- richardfey 3y ago
  > Don't worry about what some plug-in code might do to your program. Extism is built with security as a core principle, and fully sandboxes the execution of all plug-in code. I find the wording a bit off here. Responsible security involves transparency along the supply chain and minimum trust, certainly not talking about worries and giving them up with ease.
  - nilslice 3y ago
    Would you suggest something more appropriate?
    - richardfey 3y ago
      I do not know Extism, but I would start from the process of verifying the security of it, and highlight what allows to check it quickly and with certainty. For example documentation of the sandbox and possibility to inspect all syscalls performed with verbose logging. These are just examples; basically I would put focus on minimal trust and maximum transparency.
    - richardfey 3y ago
      Note: there can always be problems of data exfiltration or compute power theft (as part of a botnet or mining), so owning the machine is not the only risk to mitigate.
      - nilslice 3y ago
        Both great points! Extism docs assume some level of familiarity with the security model of WebAssembly. Which unless you grant it granular permission, does mitigate the risks you’ve mentioned. I agree we should do more to specifically call out these security benefits - and also how a user could impact that default security.

foundart 3y ago

This is the first I've heard of Extism. I like their goal! "Extism's goal is to make all software programmable." [0] [0] https://extism.org/docs/overview https://extism.org/docs/overview

nilslice 3y ago
hey thank you! we are trying to make that a reality :)

crubier 3y ago

Woah Extism is exactly what I need for a project where I want a plugin system, nice random find, thank you! Question: Does extism plan to support Python as a plugin language? That seems like a big gap right now Edit: I see this issue tracking it https://github.com/extism/extism/issues/116 https://github.com/extism/extism/issues/116 and the project is ongoing https://github.com/extism/python-pdk/issues/2 https://github.com/extism/python-pdk/issues/2

nilslice 3y ago
Yes, we would love to add a Python PDK - and as you discovered have one that is very close. Python is pretty tricky given most users want libraries with native/C dependencies. With those and the Python runtime, the wasm tends to bloat up to tens of MB, rather unideal for a plug-in. If you have time, please comment on that issue though and share some thoughts or use cases so we can better prioritize support!