WasmBoxC: Simple, Fast, and VM-Less Sandboxing
&gt; Wasm sandboxing is even safe to run in the same process as other code (at least modulo Spectre-type vulnerabilities)...<p>If you want strong security with this big a modulus you may have been looking for RSA. (ugh, sorry)<p>Spectre V1 (speculative bounds check bypass &#x2F; type confusion) is basically game over for intra-process memory isolation without introducing expensive or complicated mitigations: speculation barriers at <i>every</i> branch, or a more optimized pass like Speculative Load Hardening (<a href="https:&#x2F;&#x2F;llvm.org&#x2F;docs&#x2F;SpeculativeLoadHardening.html" rel="nofollow">https:&#x2F;&#x2F;llvm.org&#x2F;docs&#x2F;SpeculativeLoadHardening.html</a>) that can bring the overhead _down_ to 20-50%.<p>From what I&#x27;ve seen, the best understanding right now is that the process is the smallest defensible unit of isolation.<p>That&#x27;s not to say that using WASM as an intermediate compilation target won&#x27;t eliminate some threats! The runtime can definitely help to improve memory safety, for example. But if you care about <i>confidentiality</i> of the data in your process, any code that is untrusted enough to require sandboxing should also be run out-of-process, e.g. across an IPC boundary.