WasmBoxC: Simple, Fast, and VM-Less Sandboxing
> Wasm sandboxing is even safe to run in the same process as other code (at least modulo Spectre-type vulnerabilities)...<p>If you want strong security with this big a modulus you may have been looking for RSA. (ugh, sorry)<p>Spectre V1 (speculative bounds check bypass / type confusion) is basically game over for intra-process memory isolation without introducing expensive or complicated mitigations: speculation barriers at <i>every</i> branch, or a more optimized pass like Speculative Load Hardening (<a href="https://llvm.org/docs/SpeculativeLoadHardening.html" rel="nofollow">https://llvm.org/docs/SpeculativeLoadHardening.html</a>) that can bring the overhead _down_ to 20-50%.<p>From what I've seen, the best understanding right now is that the process is the smallest defensible unit of isolation.<p>That's not to say that using WASM as an intermediate compilation target won't eliminate some threats! The runtime can definitely help to improve memory safety, for example. But if you care about <i>confidentiality</i> of the data in your process, any code that is untrusted enough to require sandboxing should also be run out-of-process, e.g. across an IPC boundary.