Cloud Native Computing Foundation Cloud Native Wasm Day EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sponsored Keynote: What can WebAssembly do for your Application Security and Extens... Takaya Saeki

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Sponsored Keynote: What can WebAssembly do for your Application Security and Extensibility - Takaya Saeki, Tetrate Engineer and Envoy Contributor, Tetrate

WebAssembly was born as portable bytecode to run in browsers, but it is now much more than that. Many out-of-browser environments for running WebAssembly have emerged, including proxy-wasm, Krustlet, and WASI.

Why is WebAssembly gaining a presence outside the browser?
The key lies in the fact that WebAssembly has multiple advantages that were not previously available, especially safeness and openness.

In this talk, I will summarize what features of WebAssembly are giving rise to a wide variety of applications in the world outside the browser, and reflect on how "WebAssembly outside the browser" is a great idea and its impact on application security.

A

Okay, so let me start today's my talk: what can web assembly do for your application, security and extensibility, I'm takaya saki from total inc? And today's my topic, I'm sorry. Today's my talk has two topics, so the first topic is why webassembly is gaining presence in the cloud-native world and the second topic is the impact of web assembly on application, extensibility and security.

A

So before getting started. Let me introduce this about myself on twitter, a little I'm takasaki, a software engineer title from tokyo, japan. I love programming, and here is the list of my favorite projects and about saturate. A tetrad is the substance company we are making the application. Aerial. Networking and tethoid is also a big oss. Contributor.

A

Tetra8 is one of the top android computer contributors in the world. Fedoras is the biggest contributor to android after google, and the attitude is also one of top issue. Contributors in the world.

A

Okay, let me get down to the main topic, so web assembly has many applications is accounted well today. So here I tested the schedule of today's web assembly day. As you can see, there are many applications of the web assembly, uh for example, yz or h, h-cloud computing, visual assembly and proxy button or cloud-native runtime for several function, visual assembly or a song and so on.

A

So while web assembly is gaining presence in the current world to reflect on that, let's get back to the basic property of the assembly.

A

So webassembly is safe, portable and loadable, binary, instructional format and its design. Spec lists certain design goals, for example, fast, safe, open and language, independent and portable, and much more and in today's talk I want to focus on those two three, those four properties, the safe, open language, independent and portable.

A

So web assembly has those four properties, so webassembly is safe. Web assembly can safely run untrusted codes in sandbox environment and the web assembly is open uh by the way. Let me call this open property as environmental property, sometimes for for to make it easier to understand what what open does mean, and it means web assembly has customizable interface with external environment.

A

For example, a web assembly has a external environment such as rosi, where the assembly can run on abstracted operating system, platform or proxy button in proxy button, with assembly module, communicate with external proxy applications to manipulate or handle traffic such as http or udp, traffic or tcp. Of course, and weaver assembly is portable. It's architecture independent and it's private webassembly can be compiled for many programming languages.

A

However, if you think about each properties, actually, there are other good solutions for similar goals. So, for example, naco is a google's great software fault, isolation, solution itself, invisible and polygons.

A

It lands untrusted codes, as invites some software fault isolation technique, but it lacks portability because narco is based on the native binary and the ebpf is self enviable and portable program, mainly for canon, but because it's language- it's not private, of course- and the lure is prominent embeddable script language, but it's not provoked easily a native variable format. Native library performance is there of course available, but because it's native library it has no safety net portability and java is a great language that lands anywhere. But isolation is not java's. First class season.

A

So existing solutions have similar goals, but none of them satisfies all the code. At the same time, however, web assembly is a new solution which aims to meet source codes simultaneously.

A

So this diagram shows the positioning of web assembly. As you can see, a web assembly is open and portable, safe and horrible at the same time, so wasn't realized multiple goals that were not covered simultaneously before and, as you can see, of course, as other existing solutions lack some aspects of those properties. For example, a native library is open and private, but it's not portable, not safe and lure is portable, safe and open, but because it's language lawyer is not private.

A

In other words, a web assembly is as portable as java and the web assembly is as safe as knuckle a comp and as endable as lure and as follicles as native library. So that's the strength of the assembly is under why webassembly is gaining presence in the coordinate world and because fast because being fast is a basic property of assembly. Of course, if you put a fast property in the diagram, this, the diagonal will look like this.

A

So that's why we were simply scanning presence in the cloned world. So let me talk about its impact on extensibility and security interest, so because what is an object? How much just like f what web assembly module can actually do is defined by external, but embedding interface, so version embedding interface defines functions and other symbols that the vessel module imports and exports.

A

This gives like the variety of actual interfaces for wasm, and I pick up two examples here: it's proximasum adwazi. uh I pick up this example because I think these two examples are very fundamental examples of fast embedding interfaces so and today I focus on proximation, because it's an embedded interface.

A

So what why wave assembly and why amd wave assembly in some application is important. It's because a web assembly can provide secure extensibility mechanisms for applications, so application advanced modules, communicate through bi-directional api and api, and then thanks to wasn't users of an application to make extension security, portably and in any languages.

A

And proxy version is an example of such secure extension mechanism. So proximasum is an extensibility interface for proxy servers, hardware, web assembly and the envoys reference implementation of that it provides secure and portable way to manipulate fox traffic.

A

And here is how proxy wasn't about ambush extensivity mechanism, so before wasn't uh amboy offers static systems library as its extension mechanism, so it has no isolation and synthesizers only support the language and the updating extension regarding the built.

A

However, after the adoption wasn't now, mbo extension lands in an isolated environment security and it's language, independent and dynamic load of extensions are supported.

A

So like in that example, web assembly brings secure extensibility mechanism to the cloud native applications and emblem still provides such security extensibility mechanism for application message by proxy version. You will be able to write your embryo extension by version, for example, custom authorization and custom authentication logging, so proxy version is an important example. Future security, extensive mechanism for other web assembly- so here, is that today is my topic.

A

My talk summary, so the embeddable, self-portable and portable properties wasn't gives rise to the variables interfaces and the secure extensive mechanism is a typical interface and such interface I mean, and the proxy version is an extensive mechanism for proxy and what will continue to bring new secret extensibility mechanisms to the cloud-native world applications thanks.