Embassies: Radically Refactoring the Web

on YouTube ↗30m

" summary

Argues for replacing the browser’s sprawling API with a tiny, well-specified client execution interface that runs vendor-supplied native code in per-site containers — a pico-datacenter beside the display — where communication is IP-only CEI and UI, pixels, input and crypto are the only trusted primitives. Implements WebKit as a containerized renderer, measures about 200 ms overhead to launch an ~80 MB image from an untrusted cache, and shows that protocolized interactions remove implicit CSRF/XSS/history leaks and let vendors patch client stacks quickly.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 1:58Why the Api Is Broken
3. 3:47What Is the Web Api
4. 10:04How Big Does a Client Execution Interface Have To Be To Replace the Web
5. 13:02What Happens to all of the Browser Facilities for Client-Side Communication
6. 19:57Does It Work
7. 21:30How Does Refactoring Fix Specific Security Problems
8. 22:01Cross-Site Scripting

" related talks

• 01h 13mKeynote: The Hidden Architecture of our Time: Why This Internet Worked, How We Could Lose It...Dan Kaminsky · Black Hat USA 2016
• 21mWeb Browsers: Om nom nomSteve Klabnik · dotRB 2013
• 43mResponsive, Adaptive and ResponsibleChristian Heilmann · NEJS Conf 2015
• 32mMake Websites, Not AppsSoledad Penadés · CSSConf.Asia 2016
• 44mAdvancing the web without breaking it?Christian Heilmann · beyond tellerrand Düsseldorf 2015
• 30mAchieving the Web Isolation Nirvana - How far along are we?Pedro Fortuna, Jasvir Nagra · OWASP 20th Anniversary 2021
• 28mThe App-Changing Magic (and Joy) of Web APIsTrent Willis · HalfStack Charlotte 2023
• 40mA Tale of Two WebsKyle Simpson · JavaScript fwdays’23