Mozilla has partnered with Fastly, Intel and Red Hat to form the Bytecode Alliance to build a secure-by-default future for WebAssembly and to take it beyond the browser.
“WebAssembly is changing the web, but we believe WebAssembly can play an even bigger role in the software ecosystem as it continues to expand beyond browsers,” explained Luke Wagner, Distinguished Engineer at Mozilla and co-creator of WebAssembly. “This is a unique moment in time at the dawn of a new technology, where we have the opportunity to fix what’s broken and build new, secure-by-default foundations for native development that are portable and scalable. But we need to take deliberate, cross-industry action to ensure this happens in the right way.”
What is the Bytecode Alliance
This year we saw many initiatives by Mozilla pushing WebAssembly beyond the web. The Bytecode Alliance is also a step forward in that direction with an aim to make it safe for developers to use untrusted code, no matter where they’re running it—whether on the cloud, desktop or IoT devices. This common, reusable set of foundations can be used on their own or embedded in other libraries and applications.
As developers run untrusted code in many new places, from the cloud to IoT devices, they open up security and portability challenges. With WebAssembly and emerging related standards such as WASI and WebAssembly Interface Types, the Alliance plans to address challenges that occur when you try to run the same code across these different systems (server, edge, browser, mobile, and more platforms).
Bytecode will combine Wasmtime, a runtime for WebAssembley and WASI, Fastly’s Lucet, WebAssembly compiler, and runtime, Intel’s WebAssembly Micro Runtime and code generator Cranelift. It will also include cargo-wasi, a lightweight Cargo subcommand that compiles Rust code to target WebAssembly as well as wat and wasmparser. These set of projects are likely to expand as the Alliance grows. Once the Alliance is formalized, an open governance model consistent with open-source best practices and strong community norms will be established.
Individual developers can also participate in an open-source project in the Bytecode Alliance. Each project is governed by its own committer group. Developers who are very active in shaping a project are eligible for nomination to the project’s committer group.
Introducing WebAssembly nanoprocesses
Apart from these existing projects, the Alliance is also focusing on a new architectural pattern emerging in WebAssembly. This pattern called the “WebAssembly nanoprocess“, gives you most of the benefits of a process (the tool that operating systems use to protect programs from each other), but with much less overhead and much faster communication between (nano)processes. This process, Mozilla thinks, can make massively-modular code (like the ones you see in npm, crates, and PyPI) secure by default. This means developers won’t need to worry as much about vulnerabilities in dependencies, or attackers sneaking malicious code into their codebases.
Nanoprocess can also provide memory isolation that fits anywhere. It can handle requests for tens of thousands of customers on the same machine. It can also provide software fault isolation for individual libraries in native applications. The blog mentions, “With wasm, we can replace microservices with nanoprocesses and get the same security and language independence benefits. It gives us the composability of microservices without the weight.”
This alliance was well appreciated by people and developers posting their reactions on Twitter.
I'm so very excited about this! 🎉
Setting this up with our friends at Fastly, Intel, and Red Hat was already a great experience, and I look forward to working with many others in the Bytecode Alliance! https://t.co/06RHy5NwxV
— Till Schneidereit (@tschneidereit) November 12, 2019
'these features make it possible for us to have similar isolation to that of a process, but with much lower overhead. This pattern of usage is what we’re calling a WebAssembly nanoprocess.'
WASM runtimes are an OS within an OS. Not saying that's bad.https://t.co/aDVOj5o0pX
— curioguy (@curioman2) November 13, 2019
Very Exciting! Sounds like a dream alliance. Great that you are doing this important work!
— Fabian Franz (@fabianfranz) November 13, 2019
Learn more about this alliance on Mozilla’s blog.
Read Next
Wasmer’s first Postgres extension to run WebAssembly is here!
Mozilla proposes WebAssembly Interface Types to enable language interoperability
Wasmer introduces WebAssembly Interfaces for validating the imports and exports of a Wasm module
