4 ms·
> Don't worry about what some plug-in code might do to your program. Extism is built with security as a core principle, and fully sandboxes the execution of all
by richardfey 3y ago
> Don't worry about what some plug-in code might do to your program. Extism is built with security as a core principle, and fully sandboxes the execution of all plug-in code.
I find the wording a bit off here. Responsible security involves transparency along the supply chain and minimum trust, certainly not talking about worries and giving them up with ease.
- nilslice 3y agoWould you suggest something more appropriate?
- richardfey 3y agoI do not know Extism, but I would start from the process of verifying the security of it, and highlight what allows to check it quickly and with certainty. For example documentation of the sandbox and possibility to inspect all syscalls performed with verbose logging. These are just examples; basically I would put focus on minimal trust and maximum transparency.
- richardfey 3y agoNote: there can always be problems of data exfiltration or compute power theft (as part of a botnet or mining), so owning the machine is not the only risk to mitigate.
- nilslice 3y agoBoth great points! Extism docs assume some level of familiarity with the security model of WebAssembly. Which unless you grant it granular permission, does mitigate the risks you’ve mentioned. I agree we should do more to specifically call out these security benefits - and also how a user could impact that default security.