5 ms·
The writing was on the wall for in-process sandboxing with Spectre, but that seems to have faded a bit. This just re-enforces that. Things like "safe in-process
by kllrnohj 2y ago
The writing was on the wall for in-process sandboxing with Spectre, but that seems to have faded a bit. This just re-enforces that. Things like "safe in-process sandboxing with WASM" are just a fantasy, it can't be implemented.
- lxgr 2y agoSafe in-process sandboxing is obviously possible and even trivial. It does get harder if you care about performance, though.
- saagarjha 2y agoIf the costs are high enough you’re basically reimplementing multi-process isolation from first principles.
- willtemperley 2y agoWhat I know as a developer is web security is really hard. Last week there was a DOM clobbering gadget deep in my TypeScript world and I really didn't have the energy to understand who wants to clobber my DOM and why they need a gadget. I want to build stuff and what worries me is this stuff is just simply not foreseeable.
- lxgr 2y agoDOM security is a completely different beast from process isolation with WASM (in a web context or otherwise). The attack surface is vastly greater, due to the much larger API complexity.
- kllrnohj 2y ago"trivial" how do you figure? Remember these exploits bypass your own code's conditionals over a shockingly far duration. Unless you just mean for incredibly restrictive usages such as eBPF? possible absent any performance concerns at all, yeah sure
- lxgr 2y ago> Unless you just mean for incredibly restrictive usages such as eBPF? I was actually thinking something more like a bytecode interpreter that runs one operation and then sleeps until the next full wall clock second, but yes, that's my point: If you don't care about performance, you can make process isolation safe very easily.
- tptacek 2y agoI think at the point where you're suggesting 1hz bytecode interpreters the onus is kind of on you to be clear you're not talking about plausible points in the design space.
- lxgr 2y ago1 Hz is probably a bit too slow for practical applications, but my point is that somewhere between that, and simulating a parallel universe at each data-dependent branch, is probably a reasonably-safe spot, or more likely a spectrum that application developers get to pick their tradeoffs from.
- tptacek 2y agoI agree that 1hz is probably too slow for practical applications.
- throneaway1799 2y agoAn identically useful comment would've been to place the bounds at 0 and infinity.
- deleted 2y ago[deleted]