How Shopify Uses WebAssembly Outside of the Browser

Re:How Shopify Uses WebAssembly Outside of the Browser by devwastaken on Saturday December 19, 2020 @08:25PM (#25483020)

"readily apparent" is not good evidence. Security isn't as simple as number of lines of code. You need actual in depth analysis to even know the attack surface.

The reason why people view wasm as more secure is the runtimes used for it are VM's that control execution at an instruction level along with the wasm instruction set being far simpler than x86. Not saying wasm is magically secure because of this, there's not much actual security analysis of existing runtimes - but there are good reasons for why it can be viewed as more secure.

[ Parent | on HN ]

Re:How Shopify Uses WebAssembly Outside of the Browser by CyberRabbi on Saturday December 19, 2020 @09:16PM (#25483272)

Wasm execution doesn’t exist in the abstract. Lucet, the vm in question, does no theoretical instruction-level mitigations of which you speak. It does, however, expose a larger attack surface than simply using seccomp (not seccomp-bpf).

[ Parent | on HN ]

Re:How Shopify Uses WebAssembly Outside of the Browser by the_mitsuhiko on Monday December 21, 2020 @08:27AM (#25494686)

By definition a WASM runtime running within seccomp does not increase the attack surface. That's in fact the whole point of layering such systems. I'm not exactly sure what your point is or why you're talking about seccomp-bpf here.

[ Parent | on HN ]