spec VS wasi-libc

OWASP also provides Coraza, a port of ModSecurity available as a Go library. Coraza Proxy Wasm is built on top of Coraza and implements the proxy-wasm ABI, which specifies a set of Wasm interfaces for proxies. Finally, Apache APISIX offers proxy-wasm integration.

APISIX supports Wasm through the WebAssembly for Proxies (proxy-wasm) specification. APISIX is a host environment that implements the specification, and developers can use the SDKs available in multiple languages to create plugins.

Hi HN!

For the past few weeks we've been working on Proximal - a workflow engine that lets you quickly iterate on WebAssembly extensions for Envoy Proxy[0] (or other proxies) right on your local machine: https://github.com/apoxy-dev/proximal

This work is based on Proxy-WASM[1] extension ABI for Envoy (and other proxies like APISIX and Mosn[2]) which allows you to execute WebAssembly code on every API request a la Cloudflare Workers. As part of our wider effort at https://apoxy.dev to improve API glue code we built an experimentation / development platform and hope you will find it useful!

On the technical side this project packs Envoy itself, Envoy controller, REST API (for controlling the controller =)), React SPA, and Temporal server/worker (for orchestration) - all baked into a single Go binary. You can find more on architecture and limitations in the repository README[4].

This project is pretty early stage and we would appreciate community feedback!

Previous HN discussions on this topic:

* https://news.ycombinator.com/item?id=36113542

* https://news.ycombinator.com/item?id=22582276

---

[0] https://www.envoyproxy.io/

[1] https://github.com/proxy-wasm/spec/blob/master/docs/WebAssem...

[2] https://apisix.apache.org/ https://mosn.io/

[3] https://github.com/apoxy-dev/proximal/blob/main/README.md#ar...

Wasm Labs dev here :)

In mod_wasm, there are some differences with a pure CGI implementation. When Apache boots, it loads the configuration and initializes the WasmVM. When a new HTTP request arrives, the VM is ready so you don't need to initialize a different process to manage it.

You still need to process the request and pass the data to the Wasm module. This step is done via STDIN through the WebAssembly System Interface (WASI) implementation [0]. The same happens in the opposite direction, as the module returns the data via STDOUT.

So, the CGI pattern is still there, but it doesn't require new processes and all the code runs in a sandbox.

However this is not the only way you can run a Wasm module. In this specific case, we use CGI via WASI. In other cases, you may compile a module to fulfill a specific API, like ProxyWasm [1] to create HTTP filters for proxies like Envoy.

- [0] https://wasi.dev/

- [1] https://github.com/proxy-wasm/spec

proxy-wasm spec

The team considered to solve the issue with C++ extensions, but discarded this approach as neither APIs nor ABIs were stable. Instead, they chose to provide a stable WebAssembly-based ABI. If you're interested in a more detailed background, you can read the whole piece on GitHub.

Now there are projects like WASI that allows for interfacing with system resources for WASM code this allows for devs to target WASM runtime for their apps sliding the apps to run locally on any OS without any porting required. This could be a game changer in the future like Docker and containers was in the past decade.

So it doesn’t seem like there has been progress on a pseudo-random number generator function for typst, but there are multiple other ways to solve this: 1. Just don’t. Typst has this functional philosophy, there one input always produces the same output. (not an answer to your question tho) 2. Interface with a webassembly module which has a random number generator. So you could e.g. compile c to wasm and statically link a libc version. You would then just have to export the rand() function. (You could use any lang for this, which has a stdlib with a pseudo random number generator) 3. Implement your own. Random number generators are actually not that hard something like an LCG isn’t to complex. (Id provide an example but im on my phone rn)

Actually WASI[0] will be a better alternative, IIRC extism serialize and deserialize the data that you want to pass every time, adding a lot of overhead.

[0] https://wasi.dev

Actually, it was in wasi-libc: https://github.com/WebAssembly/wasi-libc/blob/main/libc-bott...

Proper isolation in C# is only now becoming a thing, with .Net support for WASI, which is essentially a WebAssembly sandbox which can be given extremely granular privileges (such as access to spefic file system directories, or an effective virtual file system). As an upside, the idea is that it should be possible to write the WASI packages in more or less anything.

Wasm Labs dev here :)

In mod_wasm, there are some differences with a pure CGI implementation. When Apache boots, it loads the configuration and initializes the WasmVM. When a new HTTP request arrives, the VM is ready so you don't need to initialize a different process to manage it.

You still need to process the request and pass the data to the Wasm module. This step is done via STDIN through the WebAssembly System Interface (WASI) implementation [0]. The same happens in the opposite direction, as the module returns the data via STDOUT.

So, the CGI pattern is still there, but it doesn't require new processes and all the code runs in a sandbox.

However this is not the only way you can run a Wasm module. In this specific case, we use CGI via WASI. In other cases, you may compile a module to fulfill a specific API, like ProxyWasm [1] to create HTTP filters for proxies like Envoy.

- [0] https://wasi.dev/

- [1] https://github.com/proxy-wasm/spec

Never done that, but I think you need this: https://wasi.dev/

The Python builds from the WebAssembly language runtimes [0] project target the WebAssembly System Interfaces (WASI) [1]. It allows the Python interpreter to interact with resources like the filesystem.

Many server-side Wasm runtimes supports WASI out of the box. For the browser, you need to provide a polyfill to emulate these resources like the one provided by the WASI team [2].

Regarding SQLite, these builds include libsqlite so you should be able to use it :)

- [0] https://github.com/vmware-labs/webassembly-language-runtimes

- [1] https://wasi.dev/

- [2] https://wasi.dev/polyfill/

Effective debugging results in effective programming; itk-wasm makes effective debugging of WebAssembly possible. In this tutorial, adapted from the itk-wasm documentation, we walk through how to debug a C++ data processing pipeline with the mature, native binary debugging tools that are comfortable for developers. This is a fully featured way to ensure the base correctness of a processing pipeline. Next, we will walk through an interactive debugging experience for WASI WebAssembly. With itk-wasm, we can debug the same source code in either context with an interactive debugger. We also have a convenvient way to pass data from our local filesystem into a WebAssembly (Wasm) processing pipeline.

Communication between the WASM module and the rest of the application needs to be done in very simple types (bytes, ints and floats). No complex types are supported yet. This is why most WASM compilers also provide some glue-code to map between complex types like strings or arrays. The Web Assembly System Interface (WAS) is an on-progress standard aimed to solve this last limitation; once it's mature it will allow easy interoperation with almost every environment. WASI is already available in some WSAM compilers and runtimes.