Gnash, Lightspark, and Shumway
Posted Nov 25, 2012 21:22 UTC (Sun) by khim
In reply to: Gnash, Lightspark, and Shumway
Parent article: Gnash, Lightspark, and Shumway
It was not designed for that from the beginning, so the result has some tradeoffs
Well, of course.
not all C++ code can run in a sandbox
That's kinda definition of sandbox, you know. If all code (including malicious code) can run in sandbox then why will you need any sandbox at all? All correct ANSI C/C++ code should work in sandbox (as long as it does not try to do anything forbidden, that is).
performance is not quite the same, etc.
Without sandbox it's 100 times faster, with sandbox it's only 50 times faster. Not a big deal, really.
Practically speaking, if you have a web browser with one sandbox that you spent huge efforts on (and all do), adding another sandbox means a lot of additional effort and risk. The risk comes from the fact that each sandbox will have vulnerabilities, so having more sandboxes means more of them.
Not all sandboxes are created equal. If you compare 100'000 LOC of JS sandbox (with some handwaving which should explain that it works... if you are lucky) and formally proven C++ sandbox... I'm not sure amount of effort is relevant, really.
Chrome example is pretty convincing: JS sandbox had more known vulnerabilities then C++ one, but, more importantly, most vulnerabilities are not in JS-specific parts or C++-specific parts but in common parts which work with WebKit.
to post comments)