WebAssembly and Back Again: Fine-Grained Sandboxing in Firefox 95

Re:WebAssembly and Back Again: Fine-Grained Sandboxing in Fi... by rajanaccros on Monday December 06, 2021 @11:31AM (#29461798)

How does this affect process isolation? If only some components can be sandboxed at this fine grained level, aren't we still subject to process isolation to sandbox everything else? It would seem like one still has to run fission.autostart true to isolate the components that cannot be compiled in this way, therefore not gaining the benefit of less overhead as stated in the article.

[ Parent | on HN ]

Re:WebAssembly and Back Again: Fine-Grained Sandboxing in Fi... by bholley on Monday December 06, 2021 @11:54AM (#29462198)

The purpose of RLBox is to add an extra layer of component-level isolation on top of Firefox's process-based site-level isolation. The reduced overhead is relative to the hypothetical scenario in which we performed the component-level isolation with processes (rather than WebAssembly).

[ Parent | on HN ]

Re:WebAssembly and Back Again: Fine-Grained Sandboxing in Fi... by rajanaccros on Monday December 06, 2021 @12:00PM (#29462303)

Ohh I see. Not a replacement for process based site level isolation. I just wasn't wrapping my head around that. Makes much more sense now. Thanks for the explanation.

[ Parent | on HN ]

Re:WebAssembly and Back Again: Fine-Grained Sandboxing in Fi... by majkinetor on Monday December 06, 2021 @01:03PM (#29463304)

However, without removing processes it will still be as slow as today, which I really hope browsers will do.

[ Parent | on HN ]

Re:WebAssembly and Back Again: Fine-Grained Sandboxing in Fi... by ekr____ on Monday December 06, 2021 @02:54PM (#29464716)

I think a more likely way to think about it is that this allows us to sandbox things that would otherwise would not be sandboxable. For a variety of reasons, it's probably not practical to remove the existing process sandboxes.

[ Parent | on HN ]