[{"data":1,"prerenderedAt":420},["ShallowReactive",2],{"project-43601301":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":44,"post_text":47,"what":48,"said":68,"maker_in_thread":194,"shape":205,"grid":209,"attempts":383,"same_week":384,"maker_shows":39,"maker_hidden":412,"reader_version":413,"card":414},"43601301","mem-isolate","A Rust crate for running unsafe code safely","title","Show HN: I built a Rust crate for running unsafe code safely","https:\u002F\u002Fgithub.com\u002Fbrannondorsey\u002Fmem-isolate","github.com","braxxox",1743946128,2025,113,70,661,3837,18,"notable","languages","rust crate","library",[24,25,26,27],"rust","fork","process isolation","unsafe code","roasted",-0.408,{"positive":31,"neutral":32,"mixed":33,"critical":34},2,9,1,15,27,{"execution":37,"idea":40,"performance":42,"docs":43},{"positive":38,"critical":39},0,4,{"positive":31,"critical":41},6,{"positive":38,"critical":39},{"positive":38,"critical":33},[38,38,33,38,38,38,38,33,38,38,38,45,38,38,46,33,38,38,38,33,38,33,33,33,33,33,33,45,38,38,38,38,38,33,45,33,46,45,33,33],3,5,null,{"problem":49,"audience":47,"pricing":47,"motivation":47,"time_to_build":47,"stack":60,"openness":66,"stage":67,"team_size":67},{"value":50,"source":51,"evidence":52},"Running unsafe code (e.g. calling C libraries) with less risk to the rest of the program","inferred",[53,57],{"id":54,"by":55,"text":56},"43601994","woodruffw","I don't think this meets the definition of \"safe\" in \"safe\" Rust: \"safe\" doesn't just mean \"won't crash due to spatial memory errors,\" it means that the code is in fact spatially…",{"id":58,"by":11,"text":59},"43602223","> have no hope of doing better Yeah, this is really the main use case. Its a relatively simple solution when you can't do any better. I think that's particularly helpful when…",[61],{"value":62,"source":51,"evidence":63},"Rust",[64],{"id":65},"post","open_source","unknown",{"praise":69,"objections":89,"requests":130,"questions":149,"alternatives":164},[70,78],{"value":71,"source":72,"evidence":73},"Clever trick for when you are in a bind","commenter",[74],{"id":75,"by":76,"text":77},"43601731","teknopaul","Hammer, nut. Clever trick tho if you are in a bind.",{"value":79,"source":72,"evidence":80},"Interesting and clever idea",[81,85],{"id":82,"by":83,"text":84},"43605067","syrusakbary","This is super interesting! I would be very curious to see how we can get into even more safety when running WebAssembly in Wasmer with this crate (similar to V8 isolates).…",{"id":86,"by":87,"text":88},"43604673","panstromek","That's actually a pretty clever idea, I never realized you can that. Thanks for sharing.",[90,105,113,124],{"value":91,"source":72,"evidence":92},"Fork is unsafe in multithreaded programs and can deadlock",[93,97,101],{"id":94,"by":95,"text":96},"43602260","destroycom","This isn't mentioned anywhere on the page, but fork is generally not a great API for these kinds of things. In a multi-threaded application, any code between the fork and exec…",{"id":98,"by":99,"text":100},"43604473","Svetlitski","This is likely to violate async-signal-safety [1] in any non-trivial program, unless used with extreme care. Running code in between a fork() and an exec() is fraught with peril;…",{"id":102,"by":103,"text":104},"43605426","kelnos","Please please please add a big huge warning to your crate that it should never be used in multi-threaded programs. fork() is not safe when there is more than one thread present,…",{"value":106,"source":72,"evidence":107},"Does not make unsafe code safe in the Rust sense",[108,109],{"id":54,"by":55,"text":56},{"id":110,"by":111,"text":112},"43602298","NoahKAndrews","It's not just that it won't crash, it means that an exploit in the unsafe code won't allow corrupting memory used by the rest of the program",{"value":114,"source":72,"evidence":115},"Fork is too slow for hot paths",[116,120],{"id":117,"by":118,"text":119},"43601620","djha-skin","This is cool from a theoretical perspective, but `fork()` can be prohibitively expensive, at least on the hot path. This is a cool tool that should be used with care.",{"id":121,"by":122,"text":123},"43601892","VWWHFSfQ","Which pretty much makes this whole thing pointless since a lot of unsafe code exists purely for performance reasons.",{"value":125,"source":72,"evidence":126},"Child process still has the same privileges and secrets, so isolation is weak",[127],{"id":128,"by":55,"text":129},"43602360","This is pretty immaterial from an exploit development perspective: 1. The forked process has a copy of the program state. If I'm trying to steal in-process secrets, I can do it…",[131,138],{"value":132,"source":72,"evidence":133},"Clarify limitations and warnings in docs",[134,135],{"id":102,"by":103,"text":104},{"id":136,"by":99,"text":137},"43621150","At the risk of sounding overly harsh, I just don’t think this crate is a particularly good idea. I really do mean this as constructive criticism, so let me explain my reasoning.…",{"value":139,"source":72,"evidence":140},"Support mutation of arguments and shared state",[141,145],{"id":142,"by":143,"text":144},"43606869","TheDong","This also means the function might not do what you want, i.e. if it takes a `&mut T` argument, that argument can't actually be mutated, and anything that relies on interior…",{"id":146,"by":147,"text":148},"43602533","corank","> It forces functions to be memory pure (pure with respect to memory), even if they aren't. What if the unsafe code is not supposed to be pure but mutates some memory? For…",[150,157],{"value":151,"source":72,"evidence":152},"Why use a pipe instead of shared memory",[153],{"id":154,"by":155,"text":156},"43602920","jesprenj","Why use a pipe to communicate instead of shared memory?",{"value":158,"source":72,"evidence":159},"What unsafe code motivated this",[160],{"id":161,"by":162,"text":163},"43602192","slashdev","I'd love to know what horrible library \u002F code the author was using where sandboxing it like this seemed like the best alternative.",[165,180,187],{"value":166,"source":72,"evidence":167},"OS sandboxing and process separation (seccomp, Landlock, AppContainer, Chromium sandbox)",[168,172,176],{"id":169,"by":170,"text":171},"43601802","pjmlp","Rather design the application from the start to use multiple processes, OS IPC and actual OS sandboxing APIs. Pseudo sandboxing on the fly is an old idea and with its own issues,…",{"id":173,"by":174,"text":175},"43602960","MaulingMonkey","My starting point would be Chromium's documentation, as - presumably - chrome is one of the most widely used and battle tested, user-facing, third party sandboxes running on end…",{"id":177,"by":178,"text":179},"43602855","amarshall","Linux also has Landlock now. macOS sandboxing is notoriously under-documented, has sharp edges, and is nowhere near as expressive as Linux sandboxing.",{"value":181,"source":72,"evidence":182},"Compile C to WebAssembly then to C (wasm2c) as in Firefox",[183],{"id":184,"by":185,"text":186},"43603075","nextaccountic","There is a way to sandbox native code without forking to a new process, and it looks like this https:\u002F\u002Fhacks.mozilla.org\u002F2020\u002F02\u002Fsecuring-firefox-with-webassembly\u002F Firefox…",{"value":188,"source":72,"evidence":189},"Sanitizers such as -fsanitize=undefined",[190],{"id":191,"by":192,"text":193},"43603372","dmitrygr","You can skip all this nonsense with ``` -fsanitize=undefined ```",{"comments":46,"answered":38,"key":195},[196,199,202],{"id":197,"text":198},"43617278","I've proposed these changes to shy away from the claims of \"Run unsafe code safely\" in this crate. Let me know what you think, or if you have any additional suggestions.",{"id":200,"text":201},"43617280","Oops, forgot to link the PR, lol https:\u002F\u002Fgithub.com\u002Fbrannondorsey\u002Fmem-isolate\u002Fpull\u002F44",{"id":203,"text":204},"43617262","Thanks for that suggestion. I'm adding a few more limitations in this PR: https:\u002F\u002Fgithub.com\u002Fbrannondorsey\u002Fmem-isolate\u002Fpull\u002F44 I know async-signal-safety is particularly…",{"commenters":206,"max_depth":32,"maker_replies":46,"first_comment_mins":207,"lifespan_hours":208},48,59,47,[210,212,214,215,219,221,225,227,229,232,234,236,238,240,244,247,250,253,255,256,258,259,262,265,268,270,274,275,276,280,282,283,287,289,290,294,296,299,302,303,306,307,310,313,315,317,319,321,326,328,331,333,336,338,340,342,345,347,349,351,354,357,360,363,365,368,372,375,377,380],[54,38,38,211,55,38],"commenter\u002Fcritical\u002Fidea",[110,38,38,213,111,38],"commenter\u002Fneutral\u002Fidea",[128,38,38,211,55,38],[216,38,33,217,218,38],"43602444","project\u002Fcritical\u002Fexecution","mirashii",[220,38,38,213,55,38],"43602498",[222,38,38,223,224,38],"43605146","commenter\u002Fneutral\u002Fnone","pclmulqdq",[226,38,38,223,55,38],"43606580",[228,38,38,223,224,38],"43606676",[230,38,38,223,231,38],"43609378","mubou",[233,38,38,223,224,38],"43615543",[235,38,38,223,231,38],"43620561",[237,38,38,223,55,38],"43612690",[239,38,38,223,218,38],"43608863",[241,38,33,242,243,38],"43602540","project\u002Fcritical\u002Fidea","wizzwizz4",[245,38,38,213,246,38],"43602739","jmillikin",[248,38,38,223,249,38],"43603011","Animats",[251,38,38,223,252,38],"43603161","WesolyKubeczek",[197,38,38,254,11,33],"maker\u002Fneutral\u002Fdocs",[200,38,38,254,11,33],[184,33,45,257,185,38],"project\u002Fneutral\u002Fidea",[191,33,38,213,192,38],[260,33,38,223,261,38],"43603481","Georgelemental",[263,33,38,223,264,38],"43603937","cyberax",[266,33,38,223,267,38],"43609037","rcxdude",[86,33,46,269,87,38],"project\u002Fpositive\u002Fidea",[271,33,45,272,273,38],"43608400","project\u002Fneutral\u002Fperformance","int_19h",[94,31,33,217,95,38],[169,45,33,242,170,38],[277,45,38,278,279,38],"43602471","other\u002Fneutral\u002Fnone","vlovich123",[281,45,38,278,55,38],"43602697",[177,45,38,278,178,38],[284,45,38,285,286,38],"43602971","other\u002Fneutral\u002Fdocs","anonzzzies",[288,45,38,223,55,38],"43602976",[173,45,38,285,174,38],[291,39,33,292,293,38],"43602634","project\u002Fcritical\u002Fperformance","wavemode",[295,39,38,213,55,38],"43602756",[297,39,45,257,298,38],"43602887","colinrozzi",[300,39,33,242,301,38],"43605863","Rohansi",[117,46,33,292,118,38],[304,46,45,272,305,38],"43601698","resonious",[121,46,33,292,122,38],[308,46,38,223,309,38],"43601975","deciduously",[311,46,33,292,312,38],"43603218","tombert",[161,41,45,314,162,38],"maker\u002Fneutral\u002Fnone",[98,316,33,217,99,38],7,[203,316,38,318,11,33],"maker\u002Fneutral\u002Fexecution",[136,316,33,320,99,38],"maker\u002Fcritical\u002Fidea",[322,323,45,324,325,38],"43601704",8,"project\u002Fmixed\u002Fperformance","null_investor",[58,323,38,327,11,33],"maker\u002Fneutral\u002Fidea",[329,32,38,278,330,38],"43601727","dijit",[332,32,38,278,170,38],"43601778",[334,32,38,335,243,38],"43602430","other\u002Fneutral\u002Fidea",[337,32,38,278,330,38],"43602469",[339,32,38,285,243,38],"43602825",[341,32,38,278,330,38],"43609449",[343,32,38,278,344,38],"43607717","bdhcuidbebe",[346,32,38,278,330,38],"43609441",[142,348,33,217,143,38],10,[146,350,45,257,147,38],11,[154,352,45,353,155,38],12,"project\u002Fneutral\u002Fexecution",[355,352,38,278,356,38],"43603289","im3w1l",[102,358,33,359,103,38],13,"project\u002Fcritical\u002Fdocs",[361,358,38,362,11,33],"43617269","maker\u002Fpositive\u002Fdocs",[82,364,46,269,83,38],14,[366,34,45,272,367,38],"43607446","cryptonector",[369,370,45,257,371,38],"43602033",16,"m00dy",[373,370,38,278,374,38],"43606095","chuckadams",[75,376,33,242,76,38],17,[378,18,33,242,379,38],"43603282","loeg",[381,18,38,211,382,38],"43605024","krick",[],[385,390,395,400,404,408],{"id":386,"name":387,"points":388,"category":389},"43613194","Browser MCP",616,"dev_tools",{"id":391,"name":392,"points":393,"category":394},"43593789","Whatsit",513,"games",{"id":396,"name":397,"points":398,"category":399},"43569190","OpenNutrition",311,"data",{"id":401,"name":402,"points":403,"category":389},"43614285","Lux",268,{"id":405,"name":406,"points":407,"category":389},"43627758","DrawDB",263,{"id":409,"name":410,"points":411,"category":389},"43573539","GitMCP",185,false,"v2",{"id":415,"name":5,"line":6,"ai":412,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":416,"top":18,"kw":417,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":418,"url":9,"mix":419,"praise":71,"objection":91,"sub":21},43601301,-0.41,[24,25,26,27],"0010000100030051000101111113000001315311",[31,32,33,34],1794036672395]