Webassembly looks like an upcoming standard for sandboxing efficient code on the server side as well. As it's well supported and it doesn't have a big startup runtime cost, it looks like it has a real chance of success right now (after many failed ones in the last 25 years).

Webassembly has a substantial performance hit for code containing hand-written vector loops using specialized instructions.

Things like video encoders and decoders are much slower in webassembly.

SIMD support is being worked on as far as I know, and this is a problem where there is room for a lot of improvement in the future. Generally interfacing between programming languages and systems efficiently, without too much data conversion/memory management is a harder problem than adding more low level programming support.

Yes, it looks like WASM SIMD has already shipped in V8. There are some impressive demos on this page: https://v8.dev/features/simd

It's kinda lame that none of those demos even run at 60fps, let alone 120fps on mobile for a real smooth experience, with lots of performance headroom for more than a single feature at once...

I don't think SIMD support will help here, a lot of encoder/decoder code base is hand written ASM.

There's no reason to think it won't help - the encoder/decoder code base could be written in WASM directly to ensure it uses the SIMD instructions, and those will hopefully map closely to the machine SIMD instructions.

Of course though, you're right that it'll still incur a performance penalty.

Someone needs to make a dev environment where someone can write WASM and see realtime the generated assembly instructions, together with the number of cycles to execute.

That way, the developer can tweak the input to the compiler to get exactly the sequence of instructions they wanted.

They can also hand write the output assembly, and put a patch in to the compiler saying "this generated assembly is faster that what you generated, so please generate this in the next version".

Sounds like a good margin to focus on for a... Patent? What would IP in the spade be?

Wouldn't patenting a performance optimization just work to prevent all browsers from adopting it?

Personally I find that hard to believe until it gets some mechanism of actually being able to free memory back to the OS.

Wasm is too slow, and it is not different from other techniques that compile to an IR.

It does not stop all kinds of issues, so it is not secure on its own either.

Could "fast" VMs be a solution? e.g. Firecracker. You get a fairly robust level of isolation that way and they're quick to start.

VMs feel a bit heavy, even if they are fast. If i want to wrap multiple parts of a program I could end up spawning a dozen VMs...

Not sure how relevant it is but Deno will be sandboxed by default (no disk/net access). So you could pipe in video and it could pipe out the encoded/decoded version with no access to disk.