Re:How Shopify Uses WebAssembly Outside of the Browser
by alquemist on Saturday December 19, 2020 @08:18AM
(#25477225)
In a WASM + seccomp implementation, the whole WASM runtime runs inside seccomp. Breaking out of WASM leaves one running arbitrary asm inside seccomp, which has exactly the same attack surface as directly running untrusted binaries inside seccomp. The WASM layer in WASM + seccomp simply requires an additional exploit.
[ Parent
| on HN ]
Re:How Shopify Uses WebAssembly Outside of the Browser
by CyberRabbi on Saturday December 19, 2020 @08:21AM
(#25477238)
You’re referring to seccomp-bpf, not seccomp. Seccomp-bpf + wasm has a dramatically larger attack surface than just seccomp. Please check references if you do not know the difference between seccomp-bpf and seccomp: https://en.wikipedia.org/wiki/Seccomp