Ancestors

Toot

Written by Laurence Tratt on 2025-01-28 at 11:34

New post: "Can We Retain the Benefits of Transitive Dependencies Without Undermining Security?" https://tratt.net/laurie/blog/2024/can_we_retain_the_benefits_of_transitive_dependencies_without_undermining_security.html

=> View attached media

=> More informations about this toot | More toots from ltratt@mastodon.social

Descendants

Written by David Chisnall (Now with 50% more sarcasm!) on 2025-01-28 at 11:53

@ltratt See also:

CHERIoT and the supply chain

=> More informations about this toot | More toots from david_chisnall@infosec.exchange

Written by Janne Moren on 2025-01-28 at 12:21

@ltratt

I would say this needs hardware support; some kind of privilege barrier operating across regular procedure calls between components. The callee can only see its own stack frame, and heap memory allocated by itself or explicitly passed to it.

=> More informations about this toot | More toots from jannem@fosstodon.org

Written by Laurence Tratt on 2025-01-28 at 12:23

@jannem I broadly agree.

=> More informations about this toot | More toots from ltratt@mastodon.social

Written by Tom Ritter on 2025-01-29 at 12:07

@ltratt @jannem that's broadly how wasmboxing works in Firefox to isolate some third party libraries, but without explicit hardware support https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/

=> More informations about this toot | More toots from tomrittervg@infosec.exchange

Written by Eric Mill on 2025-01-29 at 03:34

@ltratt I really, really enjoyed this post - it says a few things I've felt and appreciated someone else saying, and proposes several ideas I've not thought of before. Thank you for taking the time to write it.

=> More informations about this toot | More toots from konklone@me.konklone.com

Written by felix (grayscale) 🐺 on 2025-01-29 at 12:37

@ltratt WASM is looking like a reasonable future. I expect in about a decade that software distribution will largely become WASM modules with its strong ocap security guarantees

=> More informations about this toot | More toots from gray17@mastodon.social