Secure Sandboxing in a Post-Spectre World
summary
Covers sandboxing approaches for isolating untrusted code at the edge, focusing specifically on WebAssembly and Fastly’s open-source Lucet runtime. Describes how these technologies provide multi-tenant isolation of native code with lower resource use and better performance compared with other sandboxing methods, framed for readers familiar with edge computing.
AI-written summary · about
chapters (8)
- 0:00Start
- 24:51Priming the system: defenses
- 28:38Problematic transient execution: defenses
- 32:43Measuring side effects: defenses
- 35:46Orchestrating the attack: defenses
- 40:18Expectations (review)
- 40:55Coverage of approach
- 43:49RSAConference2020
related talks
35mModern Sandboxing: Using Web Assembly in Java
37mLucet: Safe WebAssembly Outside the Browser
54mLucet: A Compiler and Runtime for High-Concurrency Low-Latency Sandboxing
20mIsolation without Containers
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
26mSyscall Me by Your Name: Sandboxing Wasm Programs
22mIsolation without Taxation: Near-Zero-Cost Transitions for WebAssembly and SFI
29mIsolation without Containers