Gnash, Lightspark, and Shumway

Gnash, Lightspark, and Shumway

Posted Nov 25, 2012 21:22 UTC (Sun) by khim (subscriber, #9252)
In reply to: Gnash, Lightspark, and Shumway by kripkenstein
Parent article: Gnash, Lightspark, and Shumway

It was not designed for that from the beginning, so the result has some tradeoffs

Well, of course.

not all C++ code can run in a sandbox

That's kinda definition of sandbox, you know. If all code (including malicious code) can run in sandbox then why will you need any sandbox at all? All correct ANSI C/C++ code should work in sandbox (as long as it does not try to do anything forbidden, that is).

performance is not quite the same, etc.

Without sandbox it's 100 times faster, with sandbox it's only 50 times faster. Not a big deal, really.

Practically speaking, if you have a web browser with one sandbox that you spent huge efforts on (and all do), adding another sandbox means a lot of additional effort and risk. The risk comes from the fact that each sandbox will have vulnerabilities, so having more sandboxes means more of them.

Not all sandboxes are created equal. If you compare 100'000 LOC of JS sandbox (with some handwaving which should explain that it works... if you are lucky) and formally proven C++ sandbox... I'm not sure amount of effort is relevant, really.

Chrome example is pretty convincing: JS sandbox had more known vulnerabilities then C++ one, but, more importantly, most vulnerabilities are not in JS-specific parts or C++-specific parts but in common parts which work with WebKit.

---

(Log in to post comments)