News for hackers. Stuff that matters.

A comment on WasmEdge. Parent comment

Re:WasmEdge by frutiger on Tuesday November 29, 2022 @04:25PM (#33793530)
I would sincerely be curious to know how many “kloc of C/C++” you are already running in an adversarial environment and how much of a dent this project would make.
[ Parent | on HN ]
Re:WasmEdge by nerpderp82 on Tuesday November 29, 2022 @05:19PM (#33794189)
How much of a dent (non-quantitative) it would make, depends on how it is deployed. In my environment, the risk of WasmEdge outweighs its advantages.

By that argument there is no difference between 80% and 85% or 1% and 2%. One should absolutely reduce their attack surface. If the goal is to be "lightweight" as compared to containers, then WasmEdge would be running as a regular OS process and not in a jail or cgroups container. By construction, WasmEdge has a greater threat model vs rootless containers. I am huge fan of Wasm, but my appreciation for a technology doesn't outweigh the risk posed by the runtime. Its security properties are intractable.

Are you saying that end users should overlook this?

[ Parent | on HN ]
Re:WasmEdge by frutiger on Tuesday November 29, 2022 @06:03PM (#33794630)
> By construction, WasmEdge has a greater threat model vs rootless containers.

Yes — this argument makes a lot more sense to me compared to “kloc of C/C++”.

[ Parent | on HN ]