Don't Get Owned by Your Dependencies
summary
Builds a practical pipeline that compiles unsafe C/C++ libraries to WebAssembly sandboxes and integrates them via a C++ framework called RLBox, with type-level taint tracking, compile-time errors for missing checks, and an ~10% overhead on some hot paths. The system automates dozens-to-hundreds of ABI fixes and security checks, lets teams migrate libraries incrementally using an unsafe-alias pattern, and ships in Firefox since 2020 across multiple libraries and platforms.
AI-written summary · about
chapters (9)
- 0:00Start
- 2:08Native code tends to have memory safety bugs
- 3:30Existing defenses don't work
- 4:29Process sandboxing: isolate code in a new process?
- 5:48What does work: in-process sandboxing
- 7:54Example: sandboxing libjpeg from Firefox
- 9:22Step 2: Modify Firefox to use sandboxed libjpeg
- 13:59RLBox: framework to retrofit sandboxing
- 25:03Performance overheads is low
related talks
42mAdventures in Making Wasm Fast and More Secure
30mDon't Get Owned by Dependencies: How Firefox Uses Wasm to Protect Itself from Exploitable Libraries
01h 14mC++ on the Web: Ponies for developers without pwn’ing users
45mBuilding Safe and Secure Systems in Rust
24mWebAssembly as an Intermediate Language for Provably-Safe Software Sandboxing
48mDon't Trust Anything! Real-world Uses For WebAssembly
32mIsolation without Containers
34mPlaying Safely in the...