exception-handling VS cert-manager

Interesting article, thanks!

Notes on the issues mentioned there:

* The need for a manual shadow stack: This is fixed in WasmGC (in the same way it works in JS, as the link mentions).

* Lack of try-catch: This is fixed by the Wasm exception handling proposal, which has already shipped in browsers, https://github.com/WebAssembly/exception-handling/blob/main/...

* Null checks: Mostly fixed by WasmGC. The spec defines non-nullable local types, and VMs can use the techniques the article mentions to optimize them using signals (Wizard does, for example).

* Class initialization: This is a difficult problem, as the article says. J2Wasm and Binaryen are working to optimize it through static analysis at the toolchain level. Here is a recent PR I wrote that makes progress there: https://github.com/WebAssembly/binaryen/pull/6061

* The vtable overhead issue the article mentions may be a problem. I'm not aware of good measurements on it, through. There are some ideas on post-MVP solutions for method dispatch that might help, but nothing concrete yet.

* Checks for null and trapping: There has been discussion of variants on the GC instructions that throw instead of trap. Measurements, however, have not shown it to be a big problem atm, so it is low priority.

The author is right that stack walking, signals, and memory control are important areas that could help here.

Overall with WasmGC and exceptions we are in a pretty good place for Java as emitted by J2Wasm today: it is usually faster than J2CL which compiles Java to JavaScript. But there is definitely room for improvement.

It uses https://github.com/WebAssembly/exception-handling/blob/master/proposals/exception-handling/Exceptions.md which is actually supported by all major browsers already.

Yep, you're right. It's also more than just the DOM, it's web APIs in general, such as fetch, audio, webgl/webgpu, etc. WASM still needs GC, exceptions, and WASI to be able to fully interop with any host without any of the current limitations. This'll take a few years. I'm looking forward to the future in which I will be shipping WASM-only web apps to my users.

Its a part of the wasm plan to support gc https://github.com/WebAssembly/gc exceptions https://github.com/WebAssembly/exception-handling

As of Node.js 17, the v8 JavaScript engine has been updated to v9.5. The changes in this release are primarily aimed at expanding internationalization for dates and calendars as well as for the output of time zones. It also implements the WebAssembly Exception Handling proposal, designed to reduce overhead compared to current JavaScript-based workarounds.

Agreed, although at some point in a not very far feature most of those missing features will resolved. So in my mind is just a matter of time. The Wasm Community group is doing an awesome work on that :)

Here are a few examples of what needs move forward in Wasm:

* [1] Wasm Exceptions Handling: Right now Wasm is missing a way to handle exceptions natively (C++ programs can only compile to Wasm using the asyncify or longjmp/setjmp tricks via Js try/catch)

* [2] Wasm GC: Wasm Binary files are quite big (specially in interpreted languages). This is partially caused by the GC being included in the Binary itself. The GC proposal will solve this while also providing faster execution.

* [3] Wasm 64-bit Memory: currently Wasm can only operate with 32-bit data. In some contexts you may want you operate with more than 4GB of memory (for example, when operating over terabytes of data). The 64-bit memory proposal will solve that.

[1]: https://github.com/WebAssembly/exception-handling

cert-manager

The second one is a combination of tools: External DNS, cert-manager, and NGINX ingress. Using these as a stack, you can quickly deploy an application, making it available through a DNS with a TLS without much effort via simple annotations. When I first discovered External DNS, I was amazed at its quality.

On top of its core components, SpinKube depends on cert-manager. cert-Manager is responsible for provisioning and managing TLS certificates that are used by the admission webhook system of the Spin Operator. Let’s install cert-manager and KWasm using the commands shown here:

terraform { required_providers { kubectl = { source = "gavinbunney/kubectl" version = "1.14.0" } } } # The reference to the current project or a AWS project data "google_client_config" "provider" {} # The reference to the current cluster or EKS data "google_container_cluster" "my_cluster" { name = var.cluster_name location = var.cluster_location } # We configure the kubectl provider to use those values for authenticating provider "kubectl" { host = data.google_container_cluster.my_cluster.endpoint token = data.google_client_config.provider.access_token cluster_ca_certificate = base64decode(data.google_container_cluster.my_cluster.master_auth[0].cluster_ca_certificate) } #Download the multiple manifests file. data "http" "cert_manager_crds" { url = "https://github.com/cert-manager/cert-manager/releases/download/v${var.cert_manager_version}/cert-manager.crds.yaml" } data "kubectl_file_documents" "cert_manager_crds" { content = data.http.cert_manager_crds.response_body lifecycle { precondition { condition = 200 == data.http.cert_manager_crds.status_code error_message = "Status code invalid" } } } # We use the for_each or else this kubectl_manifest will only import the first manifest in the file. resource "kubectl_manifest" "cert_manager_crds" { for_each = data.kubectl_file_documents.cert_manager_crds.manifests yaml_body = each.value }

SSL certificates thanks to Cloudflare and cert-manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.crds.yaml

put the Sub-CA inside hashicorp vault to be used for automatic signing of services like https://cert-manager.io/ inside our k8s clusters.

install-cert-manager: desc: Install cert-manager deps: - init-cluster cmds: - kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/{{.CERT_MANAGER_VERSION}}/cert-manager.yaml - echo "Waiting for cert-manager to be ready" && sleep 25 status: - kubectl -n cert-manager get pods | grep Running | wc -l | grep -q 3

I've been pretty frustrated with how private CAs are supported. Your private root CA can be maliciously used to MITM every domain on the Internet, even though you intend to use it for only a couple domain names. Most people forget to set Name Constraints when they create these and many helper tools lack support [1][2]. Worse, browser support for Name Constraints has been slow [3] and support isn't well tracked [4]. Public CAs give you certificate transparency and you can subscribe to events to detect mis-issuance. Some hosted private CAs like AWS's offer logs [5], but DIY setups don't.

Even still, there are a lot of folks happily using private CAs, they aren't the target audience for this initial release.

[1] https://github.com/FiloSottile/mkcert/issues/302

[2] https://github.com/cert-manager/cert-manager/issues/3655

[3] https://alexsci.com/blog/name-non-constraint/

[4] https://github.com/Netflix/bettertls/issues/19

[5] https://docs.aws.amazon.com/privateca/latest/userguide/secur...

the Cert Manager