wasmCloud Community, 11 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: wasmCloud Community Meeting - 11 Jan 2023

Description

Welcome to the wasmCloud community meeting!

Today's Agenda: https://wasmcloud.com/community/2023/01/11/community-meeting

A

All right, everyone welcome to the wasmo cloud Wednesday for Wednesday, January, 11th, uh second community meeting of the New Year woohoo, um and we're also trying out kind of a new uh a new setup so that we can get these recordings onto YouTube quicker and into our community page so that they, you know, are a little bit easier to find and for people to catch up. uh If they end up missing a call uh without further Ado, let's go ahead and get started. We have a few things on.

A

We actually have a pretty full agenda today, um but before that very important, we have a new uh Community member in the call. um Would you like to go ahead and do an introduction.

B

uh Yes uh hi, this is Deepak ketwell I am Senior principal architect at ukg and we are building a brand new platform. So that's why I'm looking for the new open source technology that we can leverage and that interests me to join here, that's about me.

A

Awesome well, thank you for the introduction looking for the platform of the future, obviously you're in uh you're in the right place. Here we are but we're without the you know the the self um self-promotion we're glad to have you in the call yeah all right. Well, let's go ahead and get started.

A

uh We usually like to start off things with a demo, and today we have uh kind of one or two of them, um but the first one, I'm gonna go ahead and hand it over to Jordan who's, been experimenting with a waslam cloud host written in, go that's running on top of the waziro uh run time, which, if you haven't heard of that uh project before it's, uh they call themselves a zero dependency. Webassembly runtime for go developers uh won't steal any more. Your thunder Jordan go ahead and take it away.

C

I'm proud to stream, for the first time ever, I need screen sharing privileges.

C

C

Am I the second demo2 Brooks?

C

How much demo do you want? First.

A

uh You should do your two demos, I, don't think I put the are you? Are you prepped to show some of the tail skills.

C

Yeah they're they're all stood up.

A

C

A

Think I think we do demo or a Jordan demo time to to start the call and then um the second one is more of a discussion. Anyways.

C

All right, so you want me to start with the provider uh sure okay, so this is just a follow-up. I demoed this a few, uh uh however long ago, um maybe two or three weeks ago uh it was a it's an implementation of the HTTP server contract using telescale, um and if you recall um we could, we could share.

C

You know the HTTP provider to the larger internet via without have in cosmotic, without having to use a uh wormhole same thing locally. You could do it locally, but I've gone and implemented a few more of the features. um Here's the repo there's no read me, so this is useless.

C

Funnel equals true, and that's really all we want to show if you're not familiar with what funnel is tell scale. You know, obviously, is a VPN. You have to connect to your VPN and you can access all your nodes in there. However, they have found a way to allow you to expose nodes in your VPN to the internet, which is kind of cool as long as they have this I.

D

Apologize for interrupting, but you're sharing your whole screen um and so the content's kind of tiny. Could you either maximize the content or just share the tabs that you're on.

C

uh Yeah I needed the whole screen, but I will make it uh for something and then for the demo. But let me see if I can.

D

A little bit more readable on some of the other platforms. That's all all.

C

Right, uh let's see, plus which one of these Keys is Plus enhance um Okay. So whatever the first tab was the repo it's not very useful. The second tab was just showing that we have a new. um We have a new trait hanging off this link, and that trait is specifically this right here.

C

um I recommend go and read about it. It's pretty freaking cool, um but the end result is.

C

um When we start up our provider, we now get this um this tag. That tells tell scale to expose this particular node right here to the Internet. So no longer um no longer do I like have to share, like you see me, I've shared it out to one other account share these nodes out, like anyone can hit it, which is pretty cool, now caveat I am using a beta library on an alpha feature, so DNS takes forever to replicate and I didn't. I only started this a little while ago as a DNS.

C

It's not replicated so y'all won't be able to hit this. However, uh eventually, when DNS replicates, you would be able to, um but a few of the things I wanted to show off was um for free, because we have funnel we'll now notice that we do have our little green lock up here. uh So the funnel Apple, you know by implementing the funnel we get S to sell for free and that's something we did not have last time.

C

I demoed this, so you know we're getting very a lot closer to you know: production ready, apps, but then one of the coolest features I'm pretty excited about is how do I get rid of this? Go away.

C

um You'll notice that I have a to-do app here. It's garbage! Don't worry about the actual front end uh because I wrote it uh but you'll see we have buttons and these buttons don't actually do anything uh and that's because we're not like logged in here, but if we hover over logged in we'll say, you'll see access via telnet. So we come over here.

C

We turn tell scale on we refresh all of a sudden you'll see the logins gone, all the buttons now work and by way of traversing scale, tails uh telnet the provider is able to pick up authentication based things so we'll go here, we'll we'll we can add to do's and then I actually have there's no persistence. So if I reload this, it's all going to go away, but just for the sake of showing off that this isn't hard-coded I have a second account and tell scale if we connect it hit.

C

Reload reload again here we go. This is where the demo messes with you there. It is uh you'll notice that I've now logged in as a different person and if I create something new I get my new little uh Avatar.

C

I think I, don't know I'm just really excited about this. uh It's a lot of uh I've had a lot. We have a Community member um named z, who works at tell scale and is actually responsible for the entire library that I'm using tsnet uh and I can't take them enough uh for for helping me, uh you know with a thousand questions.

C

So um as a reminder, funnel is Alpha uh you actually um it's invitably, but if you're interested I have invites courtesy of z, um so if you want to play with it I'm more than happy to to give it to you and the library, the tsnet library this is using is beta. So it breaks a lot. However, it's fully it's it's working now and it's pretty great, so I'll stop there and see if there are any questions.

A

So Jordan I know that this tail scale funnel you can like, send the URL to the public internet. So we can see it right. We don't have to be in your tailscale network.

C

Correct so this is pretty much if I, if I were to give you this tsnet thing after DNS replicated it hasn't yet um yeah you'd be able to access it and that's the whole reason. I implemented like the login feature, because you'd be able to see it, but you would not be able to do anything until you connected to your telescale Network and then all of a sudden you'd be authenticated.

A

Okay, that's really cool.

C

Yeah I thought it was neat.

C

A

Then I guess anybody else have any other yeah. Anybody else have questions for Jordan on the tailscale provider. Yes, yes, I.

C

Love tail scale, so uh can can you I'm a little confused about the use case like.

E

How um about when this would be beneficial to do? Would you would you be able to.

D

E

C

No I mean so the way the use case is I, don't know, I.

B

C

This was cool, however, it's actually you that motivated me to do this watching you uh uh with all your work on the um the SSO providers that you have been doing. I was like well, we have no way with no authentication right now and I saw this and I just wanted it. uh My idea is I'll put an app out there and if you want to use it, you can connect through telescale I, don't know uh I, don't really have a good use case for it. Yet there's.

D

A there's a phenomenal use case for this. It lets you take any device on any Edge or any cloud and publish the service um live to the internet securely over a P2P private VPN. That's super powerful. You know one. The idea that you can just hang an HTTP endpoint um uh off the cloud I mean there could be. You know this could be on a Raspberry Pi, um which is what these are right here running um and you could launch this um provider and now that device is connected immediately to the internet.

D

uh The second thing is: is that then you also get secure authentication, so you could share something with your team or with a set of users uh through your telescale account, um uh but that's incredibly powerful um uh and the fact that it's um completely P2P is awesome. uh So I think that there's a bunch of great use cases for this.

C

Yeah, that's that's Liam Randall. My personal developer relations advocate.

C

uh Anyone else.

C

All right, um moving on uh to my so uh after I finish, the provider I took on my most aggressive wasm Cloud uh project yet um and about three months ago. I bought a Raspberry Pi cluster hat and essentially it takes um Raspberry Pi. uh One of these little things called.

E

C

Raspberry Pi zeros and allows you to Cluster them on top of a normal Raspberry Pi uh when it arrived I plugged it in and then realized that they sent me Raspberry Pi, zero ones which is arm 6 and 32-bit and I got really sad because Bailey told me you cannot play here um so I said: okay, fine, uh however, I got curious.

C

I found, as Brooks mentioned uh earlier, uh was Roswell wasro, which is a web assembly runtime written in purego without using seago and all that nonsense um and the reason I ran with it is because on their page they make a promise that next month, they're actually going 100 GA. So that excited me, so I started working on it a little while Some Cloud host and, as you can see here, we're logged into boink Bonk, that is my Raspberry Pi zero, V1, 32-bit, arm61 and I and I. Have this go application that I compiled down?

C

And this is my MacBook over here and as you can see, um using gouache I've gotten yeah. We now have a host ID upper 25 and when I look at the inventory, we have it showing running reservo.

C

It's not Ubuntu, it's a raspbian, but that's hard-coded, so ignore it. That's also hard-carded, so ignore it. um I promise you it's arm sex, but one of the cool things or I I've only implemented a few of the features. Blossom Cloud once you start getting into the hood, is extremely complicated.

C

I have so much more respect for the magic it does now. uh That being said, um this little Echo actor is literally the echo actor we do when we do uh wash new actor, tiny, go uh and then I'm just going to put the uh the key on it say: launch it on a host that has the version. Was you know right there, so we're gonna send it.

C

Over here we see the Raspberry Pi downloading the artifacts starting it. That is only because I'm not handling Cloud events correct it is actually running, and if we do, um we do a call on it. That's ignoring export.

C

We actually this is the Raspberry Pi doing the gas requests to guess response and I hard coded that into the actor. So that's actually the actor running right there and that's the um response from the actor and I was really proud of this. So to recap, this is awesome: Cloud running an actor on a 32-bit arm, 6-1 machine which, to my knowledge, was not possible before, for this.

A

That is all um nice job, Jordan I I feel like so I have a few questions and then I want to queue up a discussion from this.

C

um Yeah, don't don't ask them too hard because my response will be asked Brooks.

A

That's a good, that's a good loot pack mechanism, um so you are you're, calling a webassembly module on an arm. What is it v61, v6l um and so I mean this using was zero in this this. This opens up a lot of possibilities for like iot devices that are not arm V7 or arm 64, which is kind of like our limitation. Before um what kind of pie is. This is the pie one.

C

How do I, how do I turn on the camera.

C

Which way is the camera there? It is yeah, so it is the uh reading off the back Raspberry Pi, zero wv1.

A

Okay, oh it's a pi, zero wow um Jordan! Do you want to talk about any um any kind of challenges that you ran into when you were messing with this like well, one I want to know if you had to do anything special around the web assembly run time um to like get it to work with like an existing actor um and then kind of also want to hear about. If you ran into any big things that bought you for a little while or things like that,.

C

Boy, let me tell you, no actually, I can't give the Court's team enough to praise uh I, think Kevin published on the documentation. I think I I searched for esp32 and it brings up a um create a host from spec, and he pretty much drops a checklist of all the things a host has to do. There.

C

um I I just followed that checklist and implemented um in line, and you know it's. The documentation provides a chart of what guest calls and what the function um fingerprint is uh I lit I did a lot of copy paste, I didn't have to figure out much and I I've, never used ffis or anything web assembly. In my life um it was actually all very straightforward.

C

um The only issue I have is obviously this is a go run time and it's using the um tiny go uh or sorry. The wasm cloud tiny go message: Bust or a message pack library that yeah published uh I cannot run rust actors right now, because there is some skew in the message pack decoding I ran into it quite a bit when I was doing.

C

um uh uh What's it called um telescope providers, I ran into it quite a bit when I was doing providers, but it's it's a lot harder to decode uh when doing the actor so uh yeah Kevin.

E

I was just curious if the issue you were having was related to the way um byte arrays get marshalled, because that's generally, if I have, uh if I have message back problems, it's usually from from that, because different languages have different defaults for how that by array is transmitted.

C

Yeah, let's see uh I believe it is yes I think it was. But it's uh let's see was um Cloud Azure cr.io, slash Echo. He gets o three. Four I haven't done this yet so this doesn't work, don't be mad.

C

Yeah so there you go.

E

Yep, uh the U versus array is um the difference between message pack marshalling bytes as a blob versus bytes as an array, and um it's weird because if you're using both of our code generators, then they both should work. But um I'll follow up with you a little later and see if we can fix that.

C

Yeah I, uh absolutely that'd, be great. I actually have a branch in the interface repo that I was working on, for providers has a few uh patches, but I, don't know that I'd merge them because I don't really know what I'm doing um what else uh other than that Brooks. That's literally the only problem. I I hit one of the ways you know. I I would start a awesome, Cloud host stream, the gnats next to it, and then that's how I would say that he checked to make sure my provide my host was emulating.

C

You know the actual host uh on like the unlike the wire, uh but that I mean once I had that that's pretty much all I need for debugging.

A

That's really cool.

B

A

Thanks for um talking about that, uh oh sorry, Jordan I, don't mean to cut you off no.

C

A

um Yeah, thank you for kind of enumerating that I I wanted to kick off a little bit of a discussion on this, and we we have a few other things in the in the agenda. So I don't want to take too too long, um but I would love to um just talk about what this really means for wasm cloud.

A

um You all know that way. Back in the day we had, uh which is like anything more than a month ago, is way back. In the day we had a pure rust based run time for was and Cloud, um and we rewrote a lot of the scheduling and orchestration bits in Elixir. So our current main wasm Cloud runtime is a hybrid of Elixir and rust um kind of getting the getting the benefits of both um earlier like right before um right before the end of the year.

A

uh Hopefully, I'm not thinking of a different meeting, but I demoed and we've had this open source for a while, the wasmcloud JavaScript host, which is where you can run a webassembly module in a tab in a browser on the same one that you can run like on the server side, which is really compelling, um but ultimately it's another place that you can run wasm, Cloud components and then Jordan just didn't want a day.

A

That's written in, go and can be compiled to a little bit different um different targets, more constrained targets that have uh you know more more constraints around what they can download and execute, and things like that now I want to talk about. Excuse me, I want to talk about what this really means for wasm cloud, um because I want to be clear up front like we're not planning on getting rid of the OTP host in favor of just JavaScript or in favor of just go or something like that.

A

It's kind of a all of this is additive um and what it, what it gives us is abilities to take, um was on cloud applications to more places um and the reason it really made sense. You know Jordan was like or Jordan pound was zero or was looking at it was like I could can we do like wasmcloud on this, um and it's like why and a whole reason is because, like compiling, um some of the rust-based webassembly run times to arm32 is not officially supported.

A

Yet this lets you take wasmcloud applications to on 32 targets or maybe even more constrained than that with with go, and it does it with a a single statically compiled binary the JavaScript host lets you do something like you, cannot compile a webassembly runtime written in Rust, see or go into something that would run in a browser tab. That's what the the JavaScript host is good for. You can take your application.

A

You run it in the browser so right now, so many of the benefits from experimenting with these different run times just gives us lets us exercise. The promise of webassembly to you know, run a single binary anywhere without changing it, which is really exciting, um and you know where this all ends up Landing for us in terms of Owasso Cloud roadmap, which runtimes are going to be officially recommended, and all of that is all going to be the subject of experimenting and and trying this out.

A

um So uh that was I. Guess me a lot of a lot of me talking, but I wanted to kind of explain some of the background behind like why different runtimes are, um you know, kind of important in what they mean for us, Jordan I know you had that question right when we I think it was like in a DM we were, we were talking it's like. Why would we even have this um run time now that you've started like since you've started? Writing it? um Have your thought changed at all?

A

Have you do you have any more additional thoughts there.

C

uh The concept that you mentioned, of getting the computers close to the dip as possible now resonates um I mean I. Don't this little toy run time. I have here, doesn't actually launch providers, but I could see putting a provider um like a gpio provider that did everything there and then finally offloaded it via the network to you know wherever I needed it to go so so I get it now um yeah just doing it. The hard.

D

Way for now, I want to come back to something that you just kind of CJ I'm. So sorry, Adriana.

F

Oh, no, that's fine. I just have a quick uh new question um trying to link sort of this practical demo with Brooke's sort of abstract description of these values. Of the different runtimes and I'm wondering why did was Zero enable running uh actors on the 30 pit 32-bit arm architecture, where the default runtime did not?

F

Is it just like the default runtime hasn't been built for that architecture or.

A

So I think Bailey probably has a little more information here, but as far as I know, there's nothing that explicitly restricts you compiling something like wasm time to a 32-bit architecture, I'm, pretty sure it would work and I, don't I I! Think it's fine I think it's just what they call their first party supported targets is the arm Linux and Mac, x86, Linux and mac and um and windows. Maybe they just have like a you know, it's very rust-like where they have the um super support of like Level, One support and level.

A

Two um so I'm pretty sure why some time would actually work for 32-bit targets: fine, okay, um but Kevin or Bailey. Please go.

F

A

Jordan, we just give Jordan a go possibility and he whipped something out like that cool now.

C

To to your point, wazro was I, don't know how to say it was Zero uh does have listed 32-bit Linux as one of their uh tested targets. So I just wanted to add that.

F

Okay, cool thanks.

E

uh I figure Bailey probably has a better perspective on the wasm time stuff than I. Do um I know that for um for some of the other webassembly runtimes they're, they show up in Rust and and go and whatnot, but most of them have have a common C base and as useful as that is in making portable code uh a lot of times. What that ends up meaning is that certain compiled architectures aren't easy to to Target without a bunch of you know, conditional compiles and uh other stuff like that.

E

So in most cases like Brooke said it's it's not that it's technically impossible. It's just that it's either or you know low on somebody's priority list to support, uh or you know it requires a bunch of uh shims and other uh Shenanigans to get to work.

E

But, like I said I, don't I, don't know if I don't remember offhand. It wasn't. Time supports the internet.

G

Right now, Watson time doesn't have a 32-bit Target, that's part of the build pipeline, so something that is continuously building and testing. I myself haven't tried to build it for a 32-bit, although uh intuitively I know there's going to be some complications with crane, lift um uh so I. Imagine there's work to be done there.

G

um It's not that they're not interested but was sometimes um kind of. Like you know, number one use case is really similar to hours running in the cloud and a lot of the main contributors are focused on taking while some time and running it in the cloud and less so for iot, because there are so many other runtimes that are specifically targeted for it like whammer and wasm3.

G

Those two runtimes are that's like they're, that's that's their first party support and um so Blossom time may add it later, um but you know I I think exploring other runtimes. We we want to write portable webassembly modules, so um we're happy to use whatever runtime is the best one for the you know given use case if it's running in the browser, obviously we're going to be probably using something like V8 or spider monkey, but it's running on an embedded device. Hey somebody got lost here working and we haven't gotten anything else working.

G

Why Zero's gonna be the one right, um uh I I, really love that uh Jordan was able to make that be a single binary that without any dependencies that just really opens the door for a lot of other things. That's really great.

D

Yeah I gotta come back to that because you just heard a hand waved over like you just buried the whole lead there on pulling gnats and everything else and making that a single binary Jordan. That is absolutely incredible, and you know like um much like the River Jordan that gives life to so many things. I think that your little baby here Jordan can give life to a lot of cool projects.

D

I'm gonna, I'm gonna work with Caroline on our team and have her um collaborate with you on a few blogs, because this is like there's a really amazing demo that you've pulled together here uh and what you can do with it, and there has been so much friction on um on really um like. You know the whole web assembly ecosystem- and this is something Bailey uh is going to be.

D

Hopefully working on later this year- is kind of fractured and spread out over many different repositories and there's so many people that are really passionate and excited and working on moving webassembly forward. But to navigate it.

D

You sort of have to like visit all the right meetings and talk to the right people and join zulup and slack and Discord, and have the right conversations and you're just helping to make it so much more inclusive, so much more accessible, um so much easier to use, don't hand wave on what a slam dunk or grand slam that you um you. uh You know you you really just pulled off here: there's Michael Jordan and then there's Jordan Jordan, so I'll stop! Now!

D

If you come on camera, I want to see how red your face is.

C

A

All right, well, I, think that this is. This has spawned a lot of a lot of possibilities. A lot of exciting things, for you know, wasn't Cloud on on edge devices, um could look like I I, just want to reiterate, and and thank Jordan for actually getting down and experimenting with this, because this is really cool and I'm. Looking forward to um you know seeing how this evolves- um and you know I'm I'm, saying that in a little bit of a passive way, not to say that Jordan is just gonna.

A

You know Implement all the things slowly over time, but I would love to come up with like a demo or example. That would really show off using an embedded device uh like Pi zeros, um really well, and then get that working with this, because this would be a really cool thing to show foreign.

A

Maybe just one more question: if anybody else has anything and then we'll move on to the the rest of the agenda.

A

All righty um so getting on to the next parts of the agenda. um We have two big releases that we've cut in uh in the Watson Cloud organization over the past um few days. One of them is a release candidate and the other one is wash 0.14 um and so I really just want to um I really just want to talk about uh both of those but kind of in their own context. So let me go ahead and share a screen really quick.

A

um One of them that we released uh recently was uh wasmcloud OTP uh version 60, but release candidate one now um using a release candidate, isn't something that we've done before for the wazen cloud host we've used Alpha releases and wash so that people can download newer versions, get used to like some of the features that are breaking changes and test them out before we do a full release, but wasn't cloud has always been complete releases, so I want to touch on the on.

A

Why we're doing it and kind of what this means so I haven't really used. uh You know, release candidates were kind of new to me and so semi recently, and so I may be new to you as well.

A

So what this means is we have a collection of features for version 60 that we want to release for wasm cloud, but this version of the host is kind of especially big on the not necessarily outward breaking change, but it had a very larger factor in the supervision tree, which essentially allows you to run multiple logical instances of what you think of as a host on a single Lawson, Cloud host I know that's a little turtle Lee, but um you can run multiple different hosts in a single Watson Cloud process on on the beam.

A

Kevin did a little demo and talked about that and may want to add a little bit more color to that description here. In a moment um that was a very large refactor in and of itself, it's gone through many different refactoring passes again. Thank you to Giuseppe for doing a lot of these Credo warnings and none of those change functionality, but especially the the supervision tree refactor and converting the lattice cache, which was previously stored as a Nats stream. It's where we put link deaths claims all those things link.

A

Debts will actually go and be stored in a Nats key Value Store instead of a net stream, and this is so core to the wasm cloud. Experience link definitions that we want to make sure that we could cut what we call a release candidate run through some tests, see, you know, make sure nothing has drastically changed before we officially release the the 0.60, so anybody who's who's. Looking at this, this isn't going to be pulled in automatically to wash or any of the things that you've done for wasmcloud.

A

Yet, but if you're interested in testing this out, please feel free to you can grab the tarball from the from this release feel free to run some tests on it, but just to note that we're going to be um either when we're running through our tests. If we find some things that we need to fix, I'll put in a PR and probably release a release candidate too, but as soon as you see that this is version 60, then that means we've gone through a little bit more tests than just our automated pipeline.

A

um Kevin did you want to say any more details about? You know some of the big breaking changes and why we have the release candidate.

E

uh Let's see so I mean you, you covered some of the stuff with link definitions, uh I kind of went into that a while ago, and you know we had the the short version of that is.

E

uh We started using uh Nat streams for the lattice cache before Nats had a key Value Store built in so this was basically just us uh making the official change to use the the more recent version of the key value bucket.

E

It also it's a subtle difference, but it what it means is that you can query the link definitions of claims cash from any given lattice without having any of the hosts running in it, and that makes uh a pretty big difference when you're trying to run you know multiple hosts in production and then, like you, said, the supervision tree refractor was all about making sure that uh I don't know.

E

If, if you remember the so-called old code base, there were a ton of assumptions about global State and we were storing a whole bunch of things globally, which made some of our tests very difficult to run, and we had to run them in sequence and things like that, and so one of the big goals, in addition to just being able to run multiple versions of things, was to make sure that when we spin up a virtual host inside that process, we get everything isolated and it's all self-contained and self-controlled.

A

Yeah, that makes sense um anybody else have any other questions about. This was on cloud uh release.

A

Sweet um well then, one more thing: I wanted to talk about uh our latest and greatest release of wash, which is version. 14. um I dropped a couple notes for this in the community slack just because. Well, if you look at what's changed, it's been a little bit. A couple of things have gone into this version of uh of wash um many of these things actually related to things like Ci and internal things are not all Breaking changes, but just to give a general overview of the big things that changed in wash 14.

A

uh Once you go to download it, it's already released on on brew and all the package managers and everything. So you should be able to upgrade uh with your method of choice, but some of the big things is: we've actually dropped the openssl dependency in favor of using rust, TLS everywhere, which has been really sweet for portability and not running um running into issues compiling wash and then running it on a newer version um or a newer operating system that has a different, open, SSL version.

A

um Some people have run into issues with wash when pushing to GitHub container registry, where, if you're, if your GitHub username, has capital letters in it that actually technically isn't allowed in the oci spec, it's supposed to be all lower case, but that led to some friction that we actually fixed everything is just lower cased.

A

um And last but not least, you know some of the biggest changes that have gone into this version has been migrating, some of the functionality from the actual wash binary to the wash library and if you actually go to, um if you go to crates.io and take a look at washlib under the documentation, we have a ton of modules in here that actually Supply the functionality behind wash.

A

So, if you're doing something, if you're working in your own rust project- and you want to- and you want to embed some of the functionality that a wash has you can do that now with the the reusable crate. A lot of that is there and that's um that's, been really uh really a cool evolution of the wash code base.

A

So General call to action to go check out your latest and greatest wash version, um and uh let us know what you think: no, no big breaking changes in terms of we didn't change all the sub commands or anything like that.

A

All right well, that is all that I wanted to yeah Steven. You can remove all the two lowercase things now.

A

um That is all I wanted to talk about, relating to a couple of big releases that we've had in the open source side um for the last portion of the call I think I'm actually going to hand to Liam for a little bit.

A

We're going to be you know was on cloud implements many many layers of security, starting with an eye by default, and then almost everything that you do around actor invocations uh starting webassembly modules goes through multiple checks uh for securely, knowing what you're, starting what you're invoking if you're allowed to do it and by you I mean like a principal um but I, don't think that we have a really good, just high level view of all those different layers in our documentation um and that's part of what's kind of spurring this discussion, so uh Liam I won't I, won't step over your process, so I'll just go over and to you.

D

Great uh well, um there was a brief conversation on um slack today where um someone's asking about security, um and they said they were going to be able to join today's call so I hope, you're on um I I'm, not sure who, um who it was honestly on your slack name, um but what I've done is uh and we're working on a formal white paper here for this, uh but I've taken all the different layers of um of Blossom Cloud here and I've kind of laid them out, and what I wanted to do was just have a quick discussion here where we talked to the layers and I'm, hoping that maybe Bailey and Kevin can help me out by creating some tickets, or you know, filling out the uh the sticky notes here um as we go through the stack and also jump in and collaborate um as well.

D

This is a mirror board. We're just shared here um in our slack behind here. I'll put the link internally again or the link should be there. If you, if anyone else Brooks, you want to jump in all right. So um the first thing I would want to um start by calling out is: um let's just give me the overview of what the layers are, we're going to go through here. So we're going to start by talking about the security value propositions that webassembly itself brings to the table.

D

Then we're going to talk a little bit about what Wazi adds in its model and maybe introduce some of the component model. Stuff, then we'll add the security layers that are added by wasmcloud the security approach, contract driven development that we get with capability providers with actors and then finally, by running Watson cloud and clusters and then I think there's a sidebar here where we can kind of talk about how taking all of a source code out of your projects and just writing.

D

Business logic is the ultimate security innovation which is really aligned to the component model. Now, because that is, um you know, makes developers responsible for so much less. So, let's start here at the at the wasm cloud layer and the first three things I would call out would be a one. You get sandbox code.

D

um uh So if you guys could fill these out as we go through, the second would be the wasm. The web assembly layers are reactive. The third security value proposition you get is that it's denied by default.

D

um So by default there's a hard boundary between your hosts um and your um and your host operating system and your guest modules that are running a web assembly here, um Kevin Bailey, uh anything our books, anything else you guys would add, or anyone on the call that you would jump in and throw out, is um uh big um security. Innovations here.

G

D

I I would sorry I.

G

Would definitely push for the linear memory, like basically you're able to validate a what was a module uh before ever executing it, and part of that is also proving that that was a valid? Was a module isn't able to access memory outside of it? It's linear memory constraints and the fact that it is a valid, was a module and can compile as wasm basically means that it's memory safe, uh go ahead. Kevin.

D

Very cool uh what I just thought about the fly was that um webassembly has a security model. That's portable outside of Linux, it's not tightly coupled to an operating system. The security model works on edge devices on Linux, on Windows, on Mac, um even inside of browsers, I, think that is um hugely powerful.

D

um When we think about uh things from there I'm sorry, Brooks did I interrupt you.

A

Now by Kevin Kevin um started talking Kevin, you go ahead.

E

um Yeah I was just going to add to what Bailey was talking about at the below webassembly level. Is uh so actually there's another great question in there uh from Justin that I was gonna talk about, which is um a number of things that webassembly enables at a low level or prevents at the low level. Are things like buffer over on so a typical way to attack software is to cause it to crash and then execute the instruction that you've left dangling in memory um and then you then have control over that process.

E

That's physically impossible in a webassembly module.

E

um If something reads beyond the end of what exists, it will cause a panic or a trap, but you cannot physically execute code, uh byte codes that are sitting in a data segment. So um it's a subtle distinction, but in uh regular processes, um I can tell you that you know the the the value at this memory address is an OP code to execute. uh But you can't do that in webassembly.

E

The only things that are executable are uh lines of code that existed in the module when it started the module can't be modified at runtime and.

E

um Yeah you can't insert uh assembly uh if I'm understanding, Justin's question right. You can't actually insert code into the webassembly module in order to make it do things, um and then this runs into another part of the defense in-depth approach, which is even if you could do buffer overruns, or you know, get a webassembly module to uh execute your op code rather than what it's supposed to. It still doesn't have access to do anything malicious because of the other sandboxes.

D

Phenomenal points Kevin, let's, let's try to turn those into notes and let's go ahead and move on to the wazzy layer, because I do want to try to give a comprehensive overview as to all the uh how these layers fit together.

D

Here um uh with Wazi, we really have a couple of innovations that um that we embedded into cosmonic, but let me go ahead and talk about them now, at this layer, the first one I would draw out would be capability driven security, um uh so, um where now with the component model, you can start by writing contracts for what your code segments look like and then um swap those across different languages or different implementations of those contracts. The second thing I would call out- and please feel, free to rephrase Kevin or Bailey.

D

If you feel like my notes here, are a little off would be that these are now composable, because the ability to switch and use a contract that would say written in Ross with a contract that was written in c, means that you can start to. You know hot swap different languages that are there. Are there any other things with Wazi a Bailey, Kevin Brooks, or anyone on the call that you guys would throw in here.

E

um Yeah, just making sure nobody else had their their hand up. You know one of the I think one of the fallacies that people have is assuming that wazzy is like posix for webassembly.

E

um It isn't, and more importantly, is that, even though there are Imports in Wazi that allow you to do things like read to and write from files or um I'm, not I'm, not sure where it shows up, but you know, opening a socket or accessing a socket.

E

Those are those are still operations uh under the authority of the host, so the host still gets to tell you, no, you can't access that file. No, you can't access that directory. No, you can't access this file descriptor.

E

um You know it can even block you from writing to standard out. So um there's still uh there's still more control and um essentially unlimited lockdown capability based on the host.

D

uh Bailey anything you'd add here.

G

Well, you know, I have plenty to save, but uh I do think. I think it's pretty interesting that uh um that that was the point that Kevin raised, because it was actually me and Brooks this morning that were talking about how it's kind of regrettable. That lazy is um often uh you know compared to posix.

G

It's like it's, the closest allegory that we have, but what we're really doing is designing something completely new that is capability based and and so when we say that we mean um every single API is essentially a capability, that's granted by the host and I'm.

G

Basically rehashing things that Kevin just said, um but and and with with my viewpoint on it and that like in a lot of ways, that's kind of like posix, but uh because it's capability driven and the key part here is I I- put deny by default in the Wazee space unless so in the webassembly space, because in webassembly it's denied by default, because the capabilities aren't there and it's denied by default and lazy.

G

Because this is what introduces those capabilities like being able to open up a socket and what files you can read and um being able to start a thread like a lot of that stuff. That's where we're iterating and innovating, and so uh with Wazi we're coming up with the apis that have are that are based around granted capabilities.

D

Great and uh Kevin I love that you're just running ahead down the list here with the Watson thought Innovations, um because I know this is where you know you've invested a significant amount of your time is thinking through you know the microservice um and the application model here um so running down your list. A tamper-proof module that gets signed uh by um keys I would put that you can be verified with issues and signers, even when you're offline.

D

That's one of the advantages to the encryption scheme that we've chosen um uh explicit capability, allowed list, extensible policy application based on jwts jwts expire uh and are verifiable offline as well again, I'm speaking to the value props invocations are signed um as uh as well. Isn't that correct?

D

um uh What else would come out on that list here um for the was the things that wasn't Cloud adds to the ecosystem from a security perspective.

E

um Yeah I don't know if this is like a bullet item, but the the I guess the the inciting event that got me thinking about how to properly secure webassembly modules was I was doing work on uh the docker notary system and basically you could set policies that says this. Docker image can do these things, but you have to consult the notary to get that validation and the image that you're referring to has no embedded security information.

E

So what I wanted was to be able to look at a tiny, webassembly module and figure out from the module itself what it can and cannot do without having to consult either a central Authority or an online Authority.

D

um Super solid there Kevin, um let's maybe try to see if we can get through this I, know we're running tight on time. Hope folks can stay with us for another minute or two, because I think we're going to kind of wind down here, as we move up to stack now,.

A

From here, quick Liam's um I have one more that I'd love to throw in for the Watson Cloud side um just want to distinguish the signed invocations. We we both have an invocation hash to make sure it hasn't been transfer tampered with in transit, um and we know that the invocation came from a valid source in a wasm cloud lattice, because it's signed by a um a cluster seat.

A

All of the hosts in uh lattice that um communicate with each other have to have the same set of allowed um cluster issuers, which kind of sounds like the verifiable issuer signers. But there is a difference between the issuer and signer of the webassembly artifact and the issuer and signer of an invocation. We do it for both um so I just wanted to make sure that we had that down. Thank you Kevin for updating that sticky.

A

If you can't just um for lack of a better way of saying it Yeet a Nats message into a lattice and then start invoking stuff willy-nilly,.

D

All right super: um well, let's go and move on to capability providers. If we can now, capability providers are very much in the model of what the component model represents here so um I here I would maybe open the floor and say Kevin Bailey. Are there what additional things do we add here? uh Maybe that we inherit from Smithy or the validation that we're doing in our contract driven development um that we might want to call out here.

D

Assigned with capability claims, okay, um uh oh you're, moving ahead, there I'm sorry um on capability providers, so nothing additional, except um that we've adopted the Smithy tooling, um so it makes in modeling um capability providers at scale. It uses the exact same um uh set of tooling that we that AWS uses itself to model um their Cloud, um uh so I grew.

E

Up security, though, is it the Smithy stuff I.

D

Think it there's a there's, a some derived Security benefits um from um ensuring that you can have your code uh be a part of a broader ecosystem. um I think that is the uh is the sort of value props. That I would call there I'm sliding on up to um actors uh or Kevin. Did you want to maybe jump in here and and start on your couple actor ones? You laid out.

E

I didn't lay out any of the actor ones.

G

um Who did the sign capability claims? Is that you Brooks? It was me Bailey.

D

You're, my next gas for what it's worth.

G

I I mean so much, uh of course, for the Watson Cloud cluster is, uh you know, copy paste from a lot of what we were doing here with wasmcloud right, um but it's the into insecurity that you get from the combination of all of these pieces that you have before so uh I feel like when you talk about this cluster. My the first thing that had that came to mind for me was um you know you basically have proof of stake throughout the entire ecosystem.

G

So I don't know if I, if I, I and I jumped I'm jumping ahead really to the to the red here um but signed with capability claims is another way of saying that not only is it um do we say what you're allowed to do, but we also signed that. That's what you said you were allowed to do. So you can't like give yourself more power than what you were granted uh when you were built.

D

Oh wonderful Bailey. Thank you so much.

F

um Okay, so a couple.

D

Here for the uh for the actors, um stateless, it goes along with uh the reactive um approach that we find in webassembly in general, um and then um I wanted to speak to a couple security um uh innovations that I think you get from thinking about Watson Cloud as part of an ecosystem of distributed clusters, and here I think we really transfer into the abilities of software when you want to achieve security um propositions like reliability, availability.

D

You start thinking about running my code in multiple regions uh in multiple vpcs, multiple clouds, multiple devices- and this is where was I'm- glad I think shines the most because of the stateless approach that you get in the actors being able to hold State and capability providers.

D

You now have simple knobs that when you want more compute, whether it's just more instant is for more throughput or where you want more availability or more reliability, you can simply just spin this up in more places and if you've seen any of the cosmotic demos that we do out in booze, I will be at shmukon next weekend and we've got a really Lively schedule this year. Already um that's a key one that we really emphasize.

D

Quite a bit that we inherit just from um uh uh just from webassembly and I, think we're I know we're so tight on time here. Whoever's putting these couple down. Can you just jump in on those and then I've got maybe one or two more to add and we'll wrap this up and I? Thank everybody for staying a couple minutes over sure.

E

um The ones that I put in there just real quick some of the things that we tend to take for granted within Alanis or Horizon Cloud cluster uses it um every node in that cluster uh knows which other nodes are which other node is. Issuers are supported and is itself an issuer. So even if someone were able to compromise your infrastructure or compromise, your gnats infrastructure gain access to the lattice's topic structure and then issue fake invocations uh on your lattice. All the hosts would reject them.

D

Yeah those are phenomenal and let me just throw a few in here at the end, the biggest thing to me and what inspired me to fall in love with this project when Kevin pitched it to me God three or four years ago, when we were at Capital One was right. Less code maintain less code. The and I think this is the biggest thing that we actually contribute to, because developers today spend 80 percent of their time on operations and maintenance, and what that means is that you're not spending your time delivering new features.

D

Additionally, because of all the contractor and development that you get underneath this, you now have hot swappable capability providers, meaning that you can move to any clutter Edge, including your own, all without changing your cup so um uh and then the only last thing I, maybe throw in if we Zoom way out here, we've got a few big ones um uh like much of the tooling and ecosystem is written in Rust.

D

That I think applies all the way across the board, so we're sort of following those new to you know: NSA. Even the NSA recommends that people start to move to memory safe languages like rust. We do have this uh coming in a white paper here soon I'm actually reading most of this from the white paper, which includes a lot more detail on this, um so be on the lookout for that soon, uh and uh thank you, everyone so much for staying late on the on today's call.

D

Brooks I'll hand it to you and you can go ahead and read us out.

A

All right, everyone yeah just reiterating big, thank you to coming great call today, really really awesome agenda um and really looking forward to uh looking forward to next week. uh This call has actually been uh successfully streaming to YouTube unlisted, which is great because, right after we wrap up, I can actually go and grab the URL and drop it in our community page and it'll be on the website. So, looking forward to doing this from now on, anyone who actually came uh and is watching the live stream on on any of the various sources.

A

Thank you for coming, um we're probably going to start doing things like tweeting out and and letting people know that these things are actually happening. So people can people can attend, um but with that being said, I think we can go ahead and stop recording and.