Hacker News Reader

Comment by nilslice | Hacker News Reader

Obviously this also needs to be a library in Zig, Rust, Go, Elixir, Haskell, Java, C#, F#, OCaml, PHP, Python, Ruby, Perl, C, C++ & Lean

So, it now lives as an Extism[0] wasm plugin you can call from those languages: https://modsurfer.dylibso.com/module?hash=2050e7f7a129a48df0...

[0]: https://github.com/extism/extism

View on HN

Interesting, I hadn't come across extism before. How hard would it be to package https://github.com/biojppm/rapidyaml in this way? (And do you have a extism for dummies guide?)

Extism can be really useful for packaging up and running cross-language libraries!

The most clear information about it is at: https://extism.org, but its a bit focused on the primary use case for Extism, being a universal plugin system.

There is a C PDK (https://github.com/extism/c-pdk) which you'd probably want to use in a new wrapper around your library in C++, and compile it to wasm32 freestanding or WASI, but without emscripten. Extism doesn't currently have an interop layer to emscripten.

> Don't worry about what some plug-in code might do to your program. Extism is built with security as a core principle, and fully sandboxes the execution of all plug-in code.

I find the wording a bit off here. Responsible security involves transparency along the supply chain and minimum trust, certainly not talking about worries and giving them up with ease.

Would you suggest something more appropriate?

I do not know Extism, but I would start from the process of verifying the security of it, and highlight what allows to check it quickly and with certainty. For example documentation of the sandbox and possibility to inspect all syscalls performed with verbose logging. These are just examples; basically I would put focus on minimal trust and maximum transparency.

Note: there can always be problems of data exfiltration or compute power theft (as part of a botnet or mining), so owning the machine is not the only risk to mitigate.

Both great points! Extism docs assume some level of familiarity with the security model of WebAssembly. Which unless you grant it granular permission, does mitigate the risks you’ve mentioned.

I agree we should do more to specifically call out these security benefits - and also how a user could impact that default security.

This is the first I've heard of Extism. I like their goal! "Extism's goal is to make all software programmable." [0]

[0] https://extism.org/docs/overview

hey thank you! we are trying to make that a reality :)

Woah Extism is exactly what I need for a project where I want a plugin system, nice random find, thank you!

Question: Does extism plan to support Python as a plugin language? That seems like a big gap right now

Edit: I see this issue tracking it https://github.com/extism/extism/issues/116 and the project is ongoing https://github.com/extism/python-pdk/issues/2

Yes, we would love to add a Python PDK - and as you discovered have one that is very close.

Python is pretty tricky given most users want libraries with native/C dependencies. With those and the Python runtime, the wasm tends to bloat up to tens of MB, rather unideal for a plug-in.

If you have time, please comment on that issue though and share some thoughts or use cases so we can better prioritize support!

Reply on news.ycombinator.com