infrastructure VS botnet

I've been developing a recipe search engine and meal planner at https://www.reciperadar.com/ -- all the code is free and open source.

I think the two largest challenges it has at the moment are:

- Developer experience / infrastructure setup: the service is Kubernetes-based, composed primarily of Python+Flask microservices, and although the setup steps are documented[1], they're not yet automated.

- User interface: my lack of user interface design skills are fairly apparent, I think. Having some clear UI goals to work towards would be helpful - there's likely some overlap with product design questions here (what should be the range of functionality that the the app offers?)

Any and all feedback welcome, from discussion comments to pull requests to business model questions/critiques :)

PS: Don't forget to mention one or two of your own side projects if there's anything you're looking for help with, too.

[1] - https://github.com/openculinary/infrastructure/

Hi folks,

I enjoy developing and maintaining the RecipeRadar[1] project's infrastructure in a truly open fashion.

Since the project itself is AGPL-licensed, that means I like to -- ideally -- push infrastructure documentation and changes before the associated administrative commands are run. That means that the code to the system itself is already published and available (in a chronological sense) to anyone using the service over the network at any given point in time.

However, it does introduce a set of strange risks: what if there changes expose security vulnerabilities that are _not yet_ introduced, but will be when the commands are run.

In a typical system administration scenario, generally the 'home team' acts carefully and is primarily only aware of their own actions - aside from monitoring for any externally-initiated or unexpected system behaviour during maintenance.

If a mistake is made, sometimes they'll backtrack and clean up, but for some kinds of system change, it's hard to know whether an exposed vulnerability was exploited, because the exposure window may have been very brief.

I have a sense that the best overall solution to this kind of problem (in this kind of open environment) would be an 'adversarial' system administration approach; perhaps involving some kind of mirroring.

Two (or more) systems would walk through the same series of administration steps, each with one (or more) red teams attempting to exploit the process -- already armed with the knowledge of the steps to be applied in advance.

Does that make sense to anybody, and/or can anyone provide thoughts or reading material about research into this kind of area?

[1] - https://www.reciperadar.com/

[2] - https://github.com/openculinary/infrastructure/

I was/am working on a project (https://github.com/JMS55/botnet), where users upload scripts compiled to WASM to control entities on a game server, so that they can write custom behavior.

Never heard of extism before, but second using WASM for plugins/scripting/extensions. I'm using it for botnet(1). Each player uploads a WASM program to control their bots. Both the server and the bot SDK are written in Rust, and can share some code.

4. Speed

I'm hoping to write my thesis for my master's degree on this topic this year. I'm also in the process of writing a game like screeps, where users provide a WASM script to control units for an RTS-style game (without combat though) https://github.com/JMS55/botnet.

It's amazing how simple it is to constrain memory usage, runtime duration, and secure exported functions to a WASM VM. Performance is also great - currently about ~6 microseconds per tick per unit, up to ~200 microseconds when doing expensive pathfinding. All that, while letting you program your units in Rust - the same language as the server is written in, while being able to share code with the server, and not having to use something more script-y like lua.

The boilerplate sucks, but it works well when you don't need a ton of different functions. I use wasm as a scripting language for running isolated untrusted scripts in a game I'm developing, and it works really well https://github.com/JMS55/botnet.

I'm working on a Screeps-like game using WebAssembly. You compile a script to WebAssembly, and for each robot you control on the server, it runs the script in an isolated environment to choose an action for that robot. The goal is to write a program to coordinate your robots to gather resources and expand your control of the server.

Here's an example bot script: https://github.com/JMS55/botnet/blob/master/example_bot/src/...

The basic infrastructure of the project is more or less in place, besides a visual replay viewer which I'm working on right now. What's needed is a bunch of work in designing game mechanics and APIs. I don't actually have any plans beyond bots running around and harvesting randomly generated resources at the moment. Feel free to open a discussion on the github page if you're interested in Rust, WebAssembly, and video games.

https://github.com/JMS55/botnet