News for hackers. Stuff that matters.

A comment on Lunatic is an Erlang-inspired runtime for WebAssembly.

Re:Lunatic is an Erlang-inspired runtime for WebAssembly by pjmlp on Saturday July 31, 2021 @02:59AM (#28016001)
> Lunatic builds on WebAssembly's security. We all use unaudited third-party libs that get deployed with our code, Lunatic can use capability based security to limit them.

If they happen to load all dependencies into a giant blob of linear memory, C written extensions will take care of corrupting their runtime's memory, regardless of WebAssembly "security".

[ Parent | on HN ]
Re:Lunatic is an Erlang-inspired runtime for WebAssembly by malft on Saturday July 31, 2021 @04:14AM (#28016363)
Yes, that's the point. If you need to parse a JPEG, you spawn a VM to do so. It is allowed to use n seconds of CPU, k bytes of memory, and send a bitmap back to the caller.

(Sure, you could screw it up if the caller accepts a negative-size bitmap and corrupts its heap. Lets assume that process is written in a memory-safe language.)

[ Parent | on HN ]
Re:Lunatic is an Erlang-inspired runtime for WebAssembly by pjmlp on Saturday July 31, 2021 @06:35AM (#28016933)
Assumptions is how exploits get triggered.
[ Parent | on HN ]
Re:Lunatic is an Erlang-inspired runtime for WebAssembly by sealeck on Tuesday August 03, 2021 @12:45PM (#28051318)
It would be unlikely to incorrectly assume that the language you are using is not in fact memory safe no?
[ Parent | on HN ]