Agoric SES, 13 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SES Meeting: Google ArcsJS

Description

Wherein we meet the Google ArcsJS team, who use the ses Hardened JavaScript as a foundation for mitigating user fingerprinting.

A

A

For 2022, uh we have guests this week uh from Google and uh I'd uh I'll call upon Sarah heimlich to introduce you folks.

B

Thank you, hi everyone. My name is Sarah I'm.

B

I'm we're going to be talking about today, as we may go around real, quick and just introduce all of ourselves so I'll hand it off to Bernie.

C

Hi I'm Bernie I'm, a PM and I've, been working on this project for a while part of a large area of approvable privacy that you will hear a lot about in this talk.

B

D

uh Hi sorry I'm Maria I'm, an engineer on.

B

Rtjs next is Walter.

E

Hi I'm Walter, Corman I'm, a tech lead and manager for rxjs, based in the Google San Francisco office,.

B

E

uh Hi, my name is Ray Cromwell I'm, an engineer primarily working on um rxjs.

A

E

B

D

Hi I'm another PM I work with Theron Bernie, there's two of us Sarah's working on provable privacy, which is sometimes confusing, but I work on an adjacent team, they're interested to hear a little bit more about this. How you all are working.

B

F

Yeah hi I'm Scott miles I'm a tech lead on rxjs I, basically architected the implementation we're using.

B

And last but not least, Google.

G

Hey I'm, Google balakrishnan, so I am the tech lead for the raksha project, which actually is used for policy enforcement and fractious.

B

All right, so we have a quick presentation. uh Well, we'll see how quick it is. We have a presentation for all of you today and then we're hoping to have um some discussion so we're going to go over some stuff and show a demo as well.

B

All right. Can everyone see my screen Perfect all right. So, as I said, our team name is rxjs because we have the JavaScript implementation, um but you might have also heard this called policy protected data access for untrusted components, which is the name of our wicg proposal. So.

B

All right, so, what's our overall goal, so you have heard both Bernie and Sarah mentioned uh approvable privacy, which is the broader group that we are a part of at Google, um and our whole goal is to have privacy preservation on the open web. So, instead of and one of our big principles is user sovereignty. So, instead of a traditional programming model, where you have your data, your user data come to the code we flip that around and instead we have the data.

B

Your code go to the user's data, so that way they have sovereignty over that data and the code comes to them.

B

Why is this important? What? Are problems? Are there well there's a whole bunch of them out there that we're been looking at how we can help solve with this programming?

B

Paradigm there's one of the things we're going to show you a demo of here is a picker for fingerprintable data, so in particular, we've been looking at fonts, but we also have a demo for photos these days, your permission, pop-ups well, first off there's, so many of them users often get overwhelmed and just say yes to everything, especially now that we have to say yes to cookies on every website, um but they're, also overly generic. So when I logged into Zoom here today, Zoom asked for permission to see my camera and I'm.

B

Now, given Zoom permission for to see my camera for all eternity, so at will you know, zoom.us can turn on my camera.

B

um I talked about permission, pop-up overload already, but also this gives us the ability to embed and extend web apps um and we'll show more of how this works as we go.

B

So there are three Core Concepts in our framework, and these are outlined in The wicg Proposal, which the link is there if you're interested in viewing it or commenting on it um and there's three components: there are lightweight code components, there's a policy language that governs how they interact with each other and how they can access data and then finally, there's a UI composition framework that allows you to combine these in different ways that the user can see I'm going to go into each of these now in more detail.

B

The key to the lightweight components is that they are executed in a secure environment and that's what allows us to then do policy language, because they can't interact with things unless they've declared it. You can also mix and match them. We like to call this Choose Your, Own Adventure, so in the little example I have here, we have this data, which is your date of birth and we're calculating your age, but we could also change it. So maybe it's going to calculate your birthstone.

B

Those would both be different things and you can kind of mix and match them in this way. They're also a mutable function based which is really important, and a lot of why we're using cess and we'll be talking a lot more about this, but here's just an example of what a birthstone calculator might look like. You can update to the date of birth. It's going to figure out what your gemstone is based on the month.

B

B

um We're gonna, try very hard to not use these words, but they might slip out so I wanted to very briefly touch on them. These are what we call them internally um and then our code and all those kinds of things. So if you go on GitHub you'll see these words used a lot. A particle is what we call one of these lightweight code components store is just where your data is stored. It's fairly easy, but a recipe is a combination of these particles in stores.

B

Normally, you can think of it kind of like a program right. It's your combination, it's how they're wired together.

B

All right the policy language, um as we've mentioned, we are approvable privacy. That's what we're interested in in the policy language is. What lets us do that it lets. You say: hey some parts of our code are trusted and some parts are untrusted and we want them all to declare data access and any egress of that data, and we can enforce all of that.

B

The policy language also lets us verify user actions which we're going to show a demo here in just a minute and you'll be and raise going to show that he'll talk through a little bit, how we're verifying that those actions are actually occurring and that the code just isn't claiming the user did something foreign and then the final piece is UI composition.

B

um This allows the different particles or code components to delegate rendering they can either render themselves or they can say, hey I want to pass this rendering off. Let another code component handle it and is what allows us to have that user driven experience where things can be mixed and matched because we can compose these experiences on the Fly. We can also combine trusted and untrusted components.

B

This is much better understood with an example, um so I'm just going to explain the screenshot really quickly and then hand it off to Ray for the actual demo, but you're going to see um in the demo. You're gonna see this, which is a uh it's based on quill, which is an open source document editor and we've replaced the font picker with our own. So this is actually the font. Picker is being run in arch.js, it's a its own code component or a few of them, and so this green box tool is safe.

B

That's why it's green and it's being rendered into the page with this UI composition framework.

B

um This is much better understood when you actually see it in action, so I'm going to hand over to Ray and let you share your screen right. I.

H

I suspect I missed the crucial world. What a suspect of Massachusetts! Oh.

E

Go ahead, Mark.

H

I suspect, I missed. Can you hear me.

D

Yeah I can hear you, okay,.

H

I suspected Mr crucial word: uh it's: what does the green represent.

B

The the green represents the portion, that's being run in Arc JS, it's one of the code, components or particles.

H

Okay, great, thank you.

D

Okay, uh let me see if I can share my screen or share.

A

Ray I believe you're, muted,.

E

uh One second I'm having Zoom trouble. You guys can hear me now right.

A

Yeah you're audible now.

E

Yeah, okay, wait: there's! Is there something where, when you share your screen on Zoom, it says it muted, my audio, because I shared my tab.

B

You need to um there's a check box that says: don't.

E

Okay, oh gotcha, there it is okay, so you guys can see this, and you can hear me: you are Audible and visible. Okay, all right.

E

So the the challenge here basically, is: we've got this like uh Google Docs, like uh Rich Text Editor, and we want to basically give it access to your native fonts that are installing your operating system uh and we do not want it to be able to fingerprint your fonts like for advertising purposes, uh and so the font picker is going to be rendered by some arbitrary untrusted code, that's loaded from somewhere on the web um and of course it could do all kinds of sort of dangerous things.

E

If it wanted to um oh wait, I should highlight something: first, you can see the effects so here I'll highlight something I'll bring up the font picker. This is the area in green. You saw before and you can see, there's like thousands of fonts here. If I scroll down, it's like every font is still on my system, and um so if I choose choose that, of course, I can highlight it now.

E

The interesting thing here is that um so this whole thing is running inside of SCS, uh which will describe like exactly like how we're using SAS for this later, but I also bring up the dev tools. It's just like a little slide up thing here. uh Just to show you a little taste, um you can see that there's a policy tab here, oh okay, didn't load that time. Let me do it again: uh you can see it says.

E

Policy is valid and then here we have sort of like this little, uh what we call IR internal representation of the uh what's happening, and this uses this project rocksha, which basically evaluates this little policy language, which verifies that data can't be uh properly. Data can't be egressed unless you actually click on it, and so the key thing here is that um the the fonts that are rendered here on the screen, um basically there's an event handler like an on click and the on click.

E

Handler is not permitted to exfiltrate data unless it's the result of a user action and that's specified in the policy. So if I click on this impact, then it can, you know, write data outside the system. Back to the quill font editor, however, if I tried to trigger that font, click artificially or via just some other, just straight up method called the policy verifier would not permit it, and so you can like rest the data.

E

So that's where, like the policy comes in so I, think that's maybe just about it, for what I can show in the demo uh Sarah um and we take questions afterwards.

F

Do you want to mention that the how it's not Franco, printable or is that.

E

Oh, yes, a good good point: Scott, okay. So the question is: uh how do we, um how do we prevent fingerprinting I mean? Let me go back and share the window for a second.

E

So you guys can see the uh you can see the window right.

E

uh So when you bring up the uh font picker and it gets your list of fonts the way this uh rendering happens is the fonts are fed to an immutable function like uh one at a time.

E

Think of it as like a map reduce uh and so the map the map function basically can transform each font, uh whether, like the font, name, the font weight, the font style things like that into whatever uh it wants as an output, and then that is stamped into a template uh and you can kind of think that it that is like the reduced part of the map reduce.

E

The key point is that the map function is like running immutable like SES space and it's it runs the untrusted code, but the reduced part stamps to template actually uh is not under the user control that actually happens as part of the system and so during the actual, rendering there's no untrusted code that sees more than one font at a time it. Never no one ever gets to see the entire list of fonts. They can't they can't create any uh external mutable States.

E

They can't aggregate uh between one font and another, so they can't basically accumulate a hash.

H

Do I have a question about that yeah. um So when you say immutable uh SCS without any further mechanism uh cannot verify that a function is immutable, but it can ensure that any mutable state it has is confined to that function. Instance uh is uh so. Can you explain what you mean by immutable when you talk about immutable functions.

E

um Yeah, we have a slide later, where we try to describe it, but what what we do is we have a SES compartment where we uh that's locked down and the user supplies some code, which we then hoist to the top level module scope, the entire scope uh and everything that is reachable from it is hardened.

E

So you can't create anything on global this. You can't uh you can't. Basically um you can't mutate anything at the top level. You can't declare any new variables, uh uh any you know new const or let variables in the top level scope, and so the function can only operate on its parameters and return, a value.

E

um If that makes sense.

H

uh It's foreign: are you using additional code analysis, so static analysis over the code or transformation over the code, in addition to SES? Yes,.

E

We do we, we, okay, we we take the function and we basically kind of repackage it uh and and sort of uh rewrite it a little bit and so that it's it it becomes like a top level function. You can't you can't create like lambdas that capture. You know, States things like that. Yeah.

H

Great yes, uh SCS, plus static analysis or transformation can ensure immutability great. Thank you. Yes,.

E

And- and that's actually kind of one of the reasons we would like we, we actually wanted to have this discussion today, because we are not 100 sure what we're doing is safe and it would kind of be cool as if there was like a uh sort of built-in sort of add-on for SCS or some other kind of like Shadow Realms, or something where we could say. Hey we'd like this to be an immutable context right. That kind of thing.

F

Even just Mark's statement is very nice to have just a somebody. Not us can say yes, this is a good thing to do. Is very helpful. So I appreciate.

D

That so yeah I.

H

I have a lot lots of thoughts about better support for immutability, um uh so so this is the beginning of what could be very productive um set of further mechanisms. Beyond current SES.

E

That makes me feel very warm and fuzzy inside to hear that.

I

So, on the on that function that you evaluate there I suspected that's the untrusted code. Is that correct.

E

uh That's correct yes, so.

I

Someone will have to write a function for this condition so now for will come and say: okay, I want to use this thing.

I

I want to write a function that renders fonts or something like that, and this is what this function is expecting based on some protocol, some sort and then knowing that this is going to run inside a SCS with a compilation step in between uh to prevent any kind of uh mutable state that can be used by the function itself, then that function runs in the SES at some point in the future and and it runs for each of the funds that the trusted code can identify and the trust the code is just simply given to the library the library is running in SES to render the piece of it and the output of that operation.

I

What is it? That's the part that I'm not clear about what the output of it is.

E

uh The output of the function you mean.

I

Yeah the function that is untrusted.

E

um So I think there's an example on the the slide that Sarah has showing right now in that little gray box on the right.

E

There's a function, there called decorator, and this is an example of the function that runs once per every font uh on your system, and you can see that the input is Family, full name weight and style, and those are the actual things that Chrome gives you for for the list of fonts on your system and what it does is it returns a new uh object, literal and uh there's a thing called key.

E

There's one called sort key, that's like to control the font sorting but, most importantly, there's a display style uh attribute that it creates uh you, see, font, family font, weight and so on, and that's actually used to set a style attribute on the template. uh If you look down at the very bottom, you'll see a span sample and then style is equal to display style.

E

So what happens is is that this immutable function called decorator, creates this extra property called display style, which is basically some CSS and that's actually stamped into that template there uh with the sample. And so that's that's how, when you see the font drop down, it actually will say it will actually have the uh the font styled its name styled in the actual font itself. So you can see what the font looks like. So you see it says like if impact as a sample. That's what that's why it looks like that.

E

Otherwise it would just be a plain list of fonts. So that's that's one example now this looks this looks and feels like it's quite uh it might be too restrictive, but actually we have uh a lot of apps. We could show where this uh is quite powerful and you can write quite uh uh powerful apps just using immutable functions and uh Transformations like this.

D

Like that, you say, I want to take questions later. I have a question on the bootstrap, uh so in I I mean you can answer it later. So uh you, you said uh your the application, the outside application, the editor is uh untrusted. So how do you initialize success uh in or where it says loaded exactly so that uh that editor application doesn't cannot compromise, uh cess or uh or the the prime modules uh so that it can get access to? Actually what you're trying to hide from it.

E

um That's pretty uh good question, I kind of know the sort of an answer to it, but maybe Scott can speak about the bootstrap uh or at least what the intent of the bootstrap was.

F

Everything's done in layers because there's no one-size-fits, all every customer is different, so some apps are trusted. Some aren't in this case. If you're producing a plug-in, it gets tricky I mean I. Sorry, this is hard, but essentially at some level. What we'll do is make a worker and lock down the worker. Okay,.

D

Would work with yeah yeah.

F

Create a sort of an island to ourselves other times we literally locked down the whole I mean, ideally, what I try to get everybody to do is lock down their app from the very beginning and then.

A

F

Just in general, because it's a good idea and I can so far we've been able to make this work. My only concern was there's libraries that do bad stuff. We use tensorflow. We use a lot of these big big gnarly libraries that like to mess with prototypes and primordials, but so far we've been able to make them play nice with SASS and so yeah.

D

F

To be all over the place, but, like I said, we have a lot of permutations that we support so go ahead.

C

I just want to drive since uh Scott was bringing up I've trusted and unplustered apps, like one use case we didn't put in the slides, is um someone um would have a website wants to host on trusted code. So in this case the web, the container is trusted, I could be I, don't think, or something like that Salesforce and would load untrusted code and then Things become a lot simpler um because then the entire content is trusted and you don't just need to compartmentalize these things.

C

The example here is harder because we want to treat the initial web pages untrusted, so we need to First, create a environment within it and then build all the rest up.

H

Have you done any work to give.

H

um Attenuated access to the Dom, so that you can give uh you can give something effective access to rendering, while still uh preventing it from climbing over the Dom and rendering outside the subtree. It's given.

F

uh Yeah so 100 this. What looks like HTML templates uh in the context where SAS is where all the danger is is uh virtualized completely so I mean it doesn't even have to be Dom. We can render to any kind of rendering environment. It's just there's a template and then a model system. So yeah it's arm's length. So we do is say it's it's just more data output from the particles from this code standpoint: here's some data- hopefully you will render this I- would like you to render this.

F

Please it's kind of always what this untrusted code can do. It makes requests so yeah. This goes through uh a system we have so we use Shadow Dom, uh all the styles are locked down and then the events that come back are cleansed. We don't send events back, we send eventlets or just have these little sniblets of data like this key is another play.

F

Ray mentioned this I don't mean to wax too much, but that we reduce the amount of data coming back so much I assumed it wouldn't be useful, but it turns out, it's actually really useful, uh so yeah we're very careful to use Dom similar to how we're using ecmascript is even this just last thing. This use of template is very much on purpose. Is a platform primitive that once we put this into uh Dom, these things are inert until we've had a chance to check that right is.

H

D

H

Work open source.

E

D

E

I I was going to say, uh there's I, think, there's a pretty interesting principle. uh We used at least for the policy to to be able to apply policy to the event system.

E

um I I use this terminology, I, don't know if Scott does but I I say that the way the event system works is you can only practically be given back what you gave in the first place. So when you set like a let's say, one click Handler on a Dom element, the event that you get back when someone clicks on it, basically is only data that you gave to the template in the first place.

E

So if you, um you know, if you want like when you, when you say, like you know, uh div like on click equals on font click, you you give it a value attribute like value equals impact is the name of the font, and so, when you click on the the font on the Dom, what the arcs runtime sends back to this untrusted code is only the value that came out of that mapping function, uh which is like, let's say the name of the font. uh You can't you can't send back.

E

Some are other military piece of like Dom event, uh like some dumb event attribute. So it's you, you get you get given back what you were. What you gave essentially.

I

And this is uh so I suspect that it looks like lit HTML on the template, but it's not quite that right. So you're doing some, your own template system there to be able to control what in this case, you pass the key. So you can read the key back in the event lab I, suspect so you're doing.

F

It yeah I'm sort of a I'm sort of lit's grandfather, so I I'm, not just me, but my a team and I invented polymer, which is sort of the precursor to lit so the Palmer team evolved into lit and I ran off with Bernie to do this, this fun stuff. Instead, so yeah I'm only mentioning DNA a lot of people go wow. This looks kind of like lit it's just because yeah the same, there's shared DNA yeah, but it is. It is custom.

F

It's a custom thing we built specifically because, like I said, the template thing I mentioned is really important to me and the jsx style doesn't have that feature of me being able to study it as Dom and not as HTML and sorry that's pretty drilled in but anyway, thank you for noticing and I will stop.

I

Yeah I I, so I, so it it feels to me that this is just a side comment. So it feels to me that this has a a similar problem um that uh the similar problem of other systems, including some from Google, where authors has to write the code in a very, very peculiar way, um obviously that that goes against the grain in terms of adoption.

I

um People have to understand that they they really can only do certain things in this.

I

This structure that you have in here um now that that's the deal breaker, but it's a very, very big limitation in terms of adoption, um so I wonder if you the fact that this is uh the all the information that you can have inside these functions, and so on um is immutable. So there's no really much that you can do there to do a program that has on stage statefulness on it. um If it's I I wonder at least two restrict it like.

F

Have you seen the demo apps because they're 100 written like this.

C

It's not a non-goal to say any arbitrary code on the web can can be plugged in here, and it will just work. I do have to change the style. That's it I think it's sort of the long run where I would see this project go is sort of a layering where this is like a one of the Frameworks that sits on top of some Basics like SCS and the policy enforcement, and so on.

C

That is shared across different Frameworks, and so, if people don't like this style, they can go and write another framework um and do that and so then, in practice you will get Frameworks that have a lot of constraints relative to the open way of doing things in any way.

C

But but they are not that different from how modern Frameworks tend to look today like this sort of function, reactive style that we've seen become very popular recently tends to break things down in very small bits that are often just pure functions and I'll get back to the statefulness in a second. So that's how that's? How sort of over a long, Arc I would see?

C

You know pun intended um this thing evolved where um um we get the layering right, which we haven't gotten by yet we're still experimenting with these things and like have really few bits that have to be trusted and right now here the template language, for example, is trusted. That's like one of the pieces that is trusted, but you could imagine uh extending Dom standards like web standards so that the Dom becomes right. Only like you can only take the principle that Ray spelled out.

C

They can only ever read out of the Dom what you put in, and you can't Traverse out of a barrier income and read computed Style Elements. If you had that, for example, you would you're a lot more flexible again. So there's all these kinds of things that we could be doing. We just don't haven't done it on the cell phone list. The way you we do, sales statefulness is by essentially having yourself a parameter. The state parameter that we just return and then it gets passed to you the next time.

C

You call it yourself, so we just make it very explicit, and here again the goal is just to make it explicit in the code so that we can do explicit policy enforcement and go like okay. This thing is stateful. It will remember we have to assume it will remember all its inputs, but that can be fine like it's not fine for the scoring function in The Decorator here, because that would be for fingerprinting, but for many other cases it's fine. You just need to distinguish it.

C

You could imagine a future version that does more deeper code analysis and just knows this piece of code does that this dot doesn't do that and it's a hidden detail. We just haven't built it that way. So so this is.

C

The principle is, uh if you layer it sufficiently and have Frameworks that impose invariants that are strict, like you can't break them, but hopefully not so bad that you can't express anything and you should be able to build a large class of applications, but you you will have to rewrite your code like this is yeah right.

E

I was just going to add just to say that, like we kind of treat State as a capability in this system, and so depending on the policy like uh during decoration when you're mapping over like a non-aggregated, what we call non-aggregatable data set like the list of fonts, the the state object is, is read only of the state Cape, the state capability.

E

We pass you, but in other contexts like let's say you want to favorite a font or something a user wants to click on something and say like I'm going to mark this, as like one of my favorite fonts, the state capability, you have becomes mutable and you can actually like put into it like. Oh, this is one of the favorited fonts, so that, like Pro, that prohibits fingerprinting where you can just accumulate a state.

E

You know over the entire thing, but if a user is actually clicking on the font, you are allowed to mutate the state via the state capability. So it's when we say it's, we don't allow States. Basically, we don't allow Java arbitrary, JavaScript State for the language level, but we do have like a state capability uh that you can acquire, uh depending on the the recipe and the policy.

I

Yeah I know all these resonates well. I think um I think the the biggest issue is going to be it's very similar to what what happened with am from Google as well like being able to bring existing libraries like let's say: oh I want to bring this library that is doing this computational piece of it. How can I do that and how can I depend on that?

I

um I suspect that you don't have a module system here to do you? Can you do Imports here and what kind of interaction can you have between different untrusted pieces or even between untrusted pieces and trusted pieces? uh It becomes very limiting in what they can do and yeah they can build a version, but they have to go all the way in.

F

uh Yeah I mean these are valid concerns for sure I think some of them are just table. Stakes like you just you have things that are trusted and things that aren't trusted and you have to deal with it. So we try to manage everything with the budgetary concept so and that the other observation that we have is that a lot of the difficult things, the high power things so I think I mentioned tensorflow media pipes, webgl webrtc, like these big gnarly things are in a separate layer where they're trusted, so we have to.

F

There is a place where you go: okay, I'm going to apply, give you a library of stuff I'm going to say this is trusted and we usually try to make those things uh a different. You know, stateless whatever, to improve, make it more likely that they're trusted, but those tend to be Leaf nodes. And then what happens? Is you know?

F

You only need one webgl thing so once that's kind of locked in where all the novelty and creativity occurs is sort of at this higher level, and we can do that in the particle space and because it's safe and plugable it's hyper modular and all that the evolution rate is just much higher, so I mean I'm, not claiming this is mathematical. This is just sort of emerged. What we've seen but I mean it's definitely happened in the media.

F

States like image guys said: well we're going to need all these services to do all this stuff and it turned out. Well, they kind of need some com, certain convolutions, and you can parameterize a lot of this stuff and then build those trusted blocks, and it just becomes power that you can invoke through the safety lens of the policy and these particles to keep the creative part in the untrusted zone. I hope that was Koji, but anyway I'm not saying we have the answers. I want to just say yeah. This is really cool.

F

It's great to have this discussion because we haven't we've been thinking about these things too. I.

E

I was going to say that if, if we had a um a much more powerful code, static code analysis and like rewriting system, some of the pain could be removed by transformation. Things like Imports might actually be supportable lately static, Imports by some transformation which actually like uh reassembles them via our recipe system where they're, basically like uh you, know, automatically extracted and put into separate particles or put into or there's like capability or a service created. That's then passed into your particle for use.

E

There might be some transformation that could remove the pain and give you like a semi standard, looking environment, but that's like kind of speculative yeah for.

H

Import specifically I mean. Certainly there are certain things you can do with with Transformations that you can't do assess without Transformations, uh but for imports specifically I. um uh They. Our whole compartment um uh system is uh so that you can provide custom import environments on a per compartment basis, if there's anything that you're doing on remapping Imports that you need transformation for rather than just using the compartment API, as is I, would actually be surprised.

I

Right, I I think at least even even with layer 0 of the module. How many f word um you you take back the control over the import. What does static or dynamic doesn't really matter. You take back the control there and then you can do all sort of things to connect the two pieces that are non-trusted and it's still preserving the the module, um the module system and the module capability.

I

So I I think Marcus on the point here like we would like to see, or we would like to know more about the what are the what would be the limitations of implementing something that controls and modules the Imports uh when, when looking at it from the lens of the harmony effort.

A

If you haven't looked at law remote, yet uh it would be. That would be a good thing to look at um we're a little bit past half time the uh I'd like to see through to the end of the deck personally and I think that I'd and if we have time after that, I think that we ought to revisit the topic of Purity since I think that would be um the functional Purity since I think that would be valuable to this group.

A

um So, let's, uh let's charge through. If you don't mind.

B

Sounds good I'm actually going to hand off to Google, so Google just tell me next slide, I real quickly for you.

G

Yeah, thank you, sir. uh So um I'll just like take a few minutes, maybe two or three minutes to kind of explain what we mean by policy enforcement um so before we dive in uh when we talk about policy enforcement, if you want to do policy enforcement, these are the four things that you need to have.

G

One is like have an understanding of the data, it could be things like jsons or like data classes or like the Java classes and stuff for that, and the other thing is like you need to understand how the data is being used like what is the? What is the behavior of the system in terms of like how is the data being accessed?

G

uh What sort of processing happens and stuff like that and I think you also need some sort of, like data flow analysis, uh to track the properties of interest on the on the on the gravity of the world on the description of the behavior? And finally, you want to have some sort of like policy that says: okay. What is a lot of? What's not allowed um I'll just dive a little bit into all of these things in the coming slides.

G

Yeah, so when we talk about the behavior of the system, so it's um there's generally a need to kind of describe the behavior of the interactions of different systems like, for example, if you think of some simple application, it may not be just one data processing system, it could be like data comes in.

G

You do some sort of mapreduce uh faded to something like a sickle query or some sort of like um image, processing pipeline or some sort of tensorflow graph and then finally, the data gets out so uh to do any kind of policy enforcement in the sense like a restrict.

G

What sort of act, processing or um accesses happens to the data you want to be able to describe all these systems and that's where um the notion of ir comes in can go to the next slide, please so so the idea is like this is kind of like um borrowed from compilers. The compilers. You have different language front ends that actually generate an IR and all the um I mean optimizations and and error handling and stuff happens on the IR. So the idea is very similar here, so you have different data processing systems.

G

uh If you have a common uh intubated representation that can be used describe the beard of the different systems, then we can actually um translate the data processing into the common ir and reason about all of them together. So that's how we would actually be able to reason about a system that actually has different data processing pipelines uh uh like the one that I showed them previously and there's actually a very well known idea and compilers and following drugs. So uh yeah next slide. Please.

G

So here is a snapshot of all the aspects that I talked about so on the and here I'm, just showing it for how we're doing this for a SQL query. So on the leftmost uh left top you have the SQL query, which is actually the data processing and then below. We actually have an IR which, if you're familiar with llvm or mlar, it's a it's a representation of what's happening.

G

So basically some data is being read, two columns are being written and some sort of anonymization is happening uh and finally, we have a description of what is allowed. So basically, we're saying you'll allow the degrees of the data if it has a differential privacy of some some Epsilon, which is long three and on the right. You just see the basically the IR represent as a graph uh and then like the the annotations like use. The data and not DPR, are actually the data for properties that we're actually tracking.

G

So, basically, what we're tracking is, uh who who has stake on the data, which is the user data and what sort of properties in terms of differential privacy does it have? So? Basically, we assume that there is no differential privacy to start with and as the data goes to, the system and various processing happens, the the properties change. For example, if you feed uh the the something with without data differential privacy into anonymized function, it gets a differential privacy.

G

But then, if you combine it with something like that, doesn't have uh differential privacy, then the final result is not differentially private. So then we just like in they build the IR the graph and then do propagation of these properties and then compare uh and then use a policy to see. If, if it's satisfying all the properties that we need in this case, we want to make sure that the data is differentially private, but that's not what we inferred so we'll actually not allow this query to run. Can you go to the.

H

Next one, how close is the analogy with llvm is this is pretty much at the same level of abstraction? Is it a single assignment formalism.

G

It is actually a single single SSA, it's actually SSA form, uh but it doesn't have all the features of llvm so llvm is like is a much gentle system. So this one it's inspired by llvm and something called mlir, uh but it's actually a very, very simpler IR ate okay, yeah and here's uh previously yeah. Here's an example where the query passes, because the properties that we inferred are satisfy what we wanted. uh What the policy says, I think that's pretty much. It is the.

B

Next set of slides are all on isolation and how we use at SAS I feel like we might have gone a little bit past this, so um in the interest of time, I might skip through some of them or go very very quickly.

B

um As Scott mentioned. Our goal is to have isolation through depth and we want to do this by removing side channels. I think we've talked about all of these already, but in particular Dom access, Global variables and prototypes. We do this removable functions with ses. We also have an ongoing research area looking into side channels more, and this is how we achieve it again.

B

We went into a lot more detail, um but basically we have this JavaScript context that spins up a worker that spins up SS compartment um and we treat the untrusted code as an object literal. It gets evaluated in that compartment.

B

um Everything is hoisted to the module scope um and we can have capabilities which are these service calls that allows us to have invocation at runtime.

H

Do you deny it by default, like cess? Does the ability to measure duration so that you're not worried about so that you can prevent side channels through uh timing attacks.

E

Yes, uh you're: okay, go ahead! You.

F

Want to answer that right: go ahead.

E

uh I was just going to mention it like you know, we don't we don't give you anything except for our own timeout function, uh which can be used to run async code, but that's it, but maybe you can go into more details. Well.

F

I was just going to say it's a budgetary. So by default you don't get anything, you don't get random time any of the impure things, but then we can. We allow people to break the rules.

H

B

Here are some examples. The first function is things we don't want to have happen and we prevent so things like sending stuff on your prototype changing Global this. Instead, we just want to be able to have these things that you can then return from the function.

I

So the values that are returned on the function- um well, I suspect you just serialize that uh using the regular worker in interaction, so you don't do any any massage. On top of these, it's just like a extra clone of the data that they provide structured, clone, that's right, and so what happened? Even these bucket, you have um what are, and maybe maybe you're, already disabling a few things in SCS like uh share right buffer or something like that.

I

You allow interaction like that or it's just disallow.

F

So I mean there's intent and then there's like specific so and if shared array buffers allowed through structure clone and it's Shinji, that's just something: I missed and we'll just fix it. So our intent is that you can't pass anything but concrete non-cyclical Json data to the agree. I've made an error, then you know we'll have to work on that, but yeah. The intent is that this is all serializable. Occasionally I mean, depending on the bus structure. We might realize it and send it over any bus.

F

So it's structured clone. It was sort of de facto the way it works in the worker setup, but anyway yeah it's a long-winded way of saying. You should probably tell us more because I may have made a mistake there, but our intent is absolutely to make this super primitive, hey.

H

Are you using hardened.

F

Yeah, all over the place- okay, great, uh probably too much I'm, always hardening everything, because I'm scared, I'm gonna. That's that's the glory of his success because you guys have plugged so many little holes and leaks and stuff that gives me lets me sleep at night.

H

Yep great great and and you're definitely airing in the right direction. If you're, you should be feeling like, maybe you're, using a Harden too much, then you're then you're airing in the right direction. So.

I

I, don't have a question on this one and this more uh for the future.

I

So we talk about the timer then, and so on, but more I met a question here. Has you done any work on on or investigating on the shadow realm and how you'll be able to maybe use Shadow round um rather than having to spin out a worker for this, and what could be the consequences of that.

F

So I mean honestly the reason we create the worker is just to isolate ourselves from so we can operate in environments. We don't control at the top level, but primarily uh well, I, guess at this point we use the worker also to just have the other thread so we're off the UI thread, because most often we work in browser environments, but I mean for a long time. We just worked in the main context and essentially a shadow Round We hardened the main context and create a compartment right there.

F

So we didn't even make a worker for a really long time. It was until we kind of got forced to because we had to do something with angular, uh but, like I said it became useful.

F

Sorry, this is a weird conversation again, it's I want I would really like to be pure, uh but we get forced into these compromises, but in any case we that's why this isn't a worker right now.

D

F

But yeah, just on that theme, I just want to say, I mean get on the weirdness budget, because we are aware that everything we do that's like not. This is not standard. This weirdness budget, pure JavaScript and pure HTML and platform stuff web components shadowed on like we try not to invent anything that we can get straight out of the sauce anyway.

E

Yeah, it is as far as the actual Shadow Realms uh spec goes.

E

We actually, um or at least I, did I looked at it uh a couple months ago and I was looking at using the shim um and um it it didn't, have all the features of SCS like I, believe it did not have like a hardened analog to it, and so I kind of punted at that time uh and just mentally registered did I come back to it because it looked like the spec was at least the shim was not like kind of like at a production ready uh uh level, but I'd be like really happy if, like Shadow Realms uh were also an option that we can plug in because, uh like the whole isolation, actual system in rxcs is also plugable.

E

Like we can put in multiple implementations, you could use SCS, we can use Shadow Realms, it's just kind of a almost like a driver that you can plug in.

I

D

I

That it's just we continue Gathering more use cases. So that's why I was asking that question, because if it is really not about isolating in a different process or or or.

I

Even relying on on something like uh start to our clone, which in Shadow realm when you communicate with it, you don't have that it's even more restricted than that, because you're only allowed to pass. Basically primitive values are around.

F

Objects around.

H

You yeah I, see on see on this slide with regard to fingerprinting uh local, compare Locale, compare is already I believe um uh denied by default or made or made non-locale specific by default uh by set by the session. uh Fp math functions are not. We have not paid any attention to that. What uh what are the fingerprinting worries with regard to FP math functions? Yeah.

E

This is just something I threw in there, because it's just kind of interesting there's a there's, a library called fingerprint.js. You can take a look at it's on GitHub, I, think and um there are I was looking for, like fingerprint vectors, which are not part of let's say capabilities. The browser is giving you like.

E

Navigator object, you know references but like just part of the JS execution environment itself and one of the uh surprising ones actually is you can detect, which browser you're in sometimes with browser version you're running in by uh the differences in the way like the math dot.

E

You know pal function and math.s sine and cosine return uh things, because there there have been subtle differences in those Library functions and also because of the jit compiler JavaScript jit, that's happening uh differences in the way the FP math would get evaluated and so they've built actual fingerprinting around, like you know, doing like cosine on some angle and then checking the result against a known thing and say: oh well, I know this is Firefox and not chroma. I know this is a certain version, but it's kind of an interesting.

E

It's probably not a practical attack, but this is an example of something uh that I was I was actually kind of shocked when I saw it.

H

Yeah I'm glad very glad to hear it. I mean I'm shocked as well. I.

D

Yeah that doesn't sound very it's not realistic. All that.

E

You might even be able to detect architecture too, like 80-bit, if you're on a machine with 64-bit FP versus 80-bit, like Intel as extra precision.

E

um It's a speculation anyway. Fingerprint.Js on GitHub has some some of these interesting things in it. uh If you.

B

Want to say right: can you confirm that the file and chat is correct.

A

And and some of us have a hard stop.

B

Yeah, this is our last slide. uh I think we kind of already went over it here, basically, uh the very last one actually is. uh These are our email addresses if you want to get in touch.

H

Do you have a link to the slides themselves.

B

I will get one uh in the meeting minutes shortly after this meeting.

H

Excellent, this is fantastic work. I am just so pleased to see this I think this can be the beginning of a great collaboration between all of us.

F

That's great I was I just want to say thank you so much I mean we're standing on your shoulders. Big time and I really appreciate it and I know. I've I've been following this work for over a decade, so I'm aware of the history too, of how glacially these kind of standard things are so really.

E

Appreciate it I started using kaha a long long time ago. I think before my.

D

E

H

Yeah, the the that's one of the reasons why I was specifically particularly sensitive with regard to uh seeing Dom issues, which is uh kaha, did the whole problem. So we had D'amato as the Dom taming, and that was stuck in in html4 days, because uh we were just not able to keep up with dom Evolution and taming. The Dom was actually harder than taming JavaScript and was never as reliable as attaining JavaScript, um and we tried to collaborate at the time.

H

Some of us, I, suspect Scott, will remember at the time with the shadow realm uh efforts uh inside Google and the polymer efforts uh to try to create to to have them be a security boundary that could support the security goals of kaha. When we spun out the SAS effort into agoric and re, you know redid it at a gorg. We just gave up on the Dom, because the Couric didn't need to, but a lot of agorkorics. You know a lot of our partners using SAS, of course, do need to like metamask.

H

So it's wonderful to see uh the Dom isolation being contributed back in I mean that's just awesome.

I

Yeah, certainly there's uh this is very interesting. That's why I wanted to have you guys around um presenting here getting getting us aware of what you're doing asking more questions about? What exactly are you doing and so on, because uh from the use cases standpoint, that's important for us to continue rathering more and more because we have all these efforts now the module system that we want to allow more control on the compartments, API, um the shadow Ram. Obviously, almost there we have implementations in all browser now, some of them behind a flag.

I

Some of them already did some of that are not behind the flag but they're already um so we're.

E

Getting there slowly.

I

But um I think uh this is very Noble uh with regard to how you do it, we have done some extensible research on other areas, as I mentioned in the previous meeting, about uh the full virtualization of the Dom, putting the restrictions on the virtual environment rather than having to harden the the I'm bringing mutability into the picture, because the restrictions added up that it imposes on developers so I think that's.

I

Another area that would like to I would like to understand better and see what so you talk about a lot of capabilities that you can, that you have that you can pivot and do a lot more things that were you present here. That's the area that I want to explore more see what else is possible with what you have.

F

You know we need to give them a demo of the node graph. I would guess.

A

Oh, and in any case any of and all of you would be welcome anytime, and also we can schedule to cover topics that are relevant to uh our mutual interests. Like.

I

Having someone from having someone from the team like popping in from that from time to time, we do it every week, but we know some people cannot come every week, but it's an hour and sometimes the topic are relevant. Sometimes they are not but just being aware of, what's going on directly, not just by looking at the repos and what people are talking about out there but being on the front line here, I'm bringing um use cases and and racing questions.

E

Yeah we'd be happy to give cooler. Demos uh uh like actually one of the things I would be really interested in the future is picking people's brains over this immutable function stuff and to what extent the SES or Shadow Realms environments could provide sort of like if not out of the box. uh You know support for it. They at least evaluate the way, we're doing it and make sure we're not doing it in in a stupid way. Yeah.

I

That's definitely a question. I I have that question like uh when you parse the function. How do you know that the function can be used and what what are the kind of um issues that we can observe there with certain functions and the goal always had to be like again in your case I think the goal is always the function has to be mutable, um but at the same time you want to allow more and more function to be able to run inside the system.

I

So how can you get that balance right, because it's very restrictive and people have a very hard time? Writing it? A functioning JavaScript.

H

Yeah, let me let me let me um uh propose a criteria with regard to the uh how this interacts with the standard efforts which is are running a full JavaScript parser uh in the browser uh is inherently both large and fragile.

H

It's fragile, because the version of JavaScript running in any particular platform might not be exactly the same as the version of JavaScript that your parser parses, um uh so the criteria I'd like to propose um is that uh any time that you have to resort to parsing to achieve the security goal uh that should put on our agenda uh what we should do with regard to proposals for the language, so that those security goals can be done without resorting to the parser.

E

E

I always feel a little dirty. Every time like we resort to mucking with the the source code, uh yeah yeah, but.

F

Even then we we don't parse, so we've been careful not to parse. We use some reflection and that's the where we get a little dirty like Ray is saying, but we definitely don't parse. Anything. That's like I've said that three times now but I'm, just because Mark said.

G

F

I'm sorry I know we're over, but I was just nobody's ever said. Anything reinforce this, so it's nice to hear that anyway. Thank you.

H

Okay, the the immutability I thought you were accomplishing by parsing and rewriting.

F

We well I'm saying we specifically know parse, we reflect so we put it in a place where it's safe and I extract functions with reflection, so I'm not actually trying to like read parentheses and curly braces or whatever, because that's.

H

F

Of the fragility comes in extract.

H

The functions using function prototype two string.

F

uh Yes, yeah largely.

H

I see very bizarre okay, interesting.

E

You would like not to have to do that if there was like some like, uh like little thing that you could just say: hey do this, and this make this function a mutable and hoist into the module scope in a.

F

There's a good way, you enshrine it and then it becomes the way yeah. So.

H

Yeah we've been, in particular collaborating with multiple the makers of the XS engine uh on things that we want to propose that are direct language support for immutability. uh We very much like to to bring you into those discussions.

H

um The thing about function, Prototype, 2 string- is that the language spec is quite explicit that an engine might not provide the source code, it might decline to provide the source code and, in fact, the XS engine uh for reasons of memory. Compactness on on devices chooses not to provide source code, so that technique will not work.

F

Okay, I mean these cases would need alternate Solutions but, like I said, there's a zillion options. I did this thing literally to avoid having to parsate so but yeah anyway. We can. This is a great another uh Branch. We can study.

H

Okay, this is great.

A

Yeah, thank you. Everyone for coming uh again we're a little bit overtime in the next meeting, they're wondering where we are um um uh but yeah again. Let's, let's continue this conversation uh whenever you are available.

A

Thank you guys.

I