Simon Willison explores his latest approach to running untrusted Python code safely within applications by utilizing MicroPython inside a WebAssembly (WASM) sandbox. The project addresses the security risks of plugin systems where code normally executes with full privileges, potentially leading to data leaks or system compromise. By leveraging wasmtime and an alpha package called micropython-wasm, Willison demonstrates how to enforce memory and CPU limits while providing controlled access to host functions through a custom thread-based request queue for persistent interpreter state.
Main topics:
- Security challenges in Python plugin systems
- Advantages of WebAssembly as a sandboxing technology
- Building the micropython-wasm alpha package
- Implementation details for persistent state and host functions
- Integration with Datasette Agent to execute code via LLMs
Main topics:
- Security challenges in Python plugin systems
- Advantages of WebAssembly as a sandboxing technology
- Building the micropython-wasm alpha package
- Implementation details for persistent state and host functions
- Integration with Datasette Agent to execute code via LLMs
Python 3.15 is set to introduce transformative improvements including lazy imports to defer library loading costs, a new immutable frozendict type, significant enhancements to the native JIT compiler, and an explicit roadmap for WebAssembly support via PEP 816. The article also highlights recent developments in the Python ecosystem such as using Rust to build standard library components, tools for exploring profiler data, and security insights regarding package compromises.
BrowSDR is a high-performance, browser-based Software Defined Radio (SDR) receiver designed specifically for HackRF devices. By utilizing WebUSB and WebAssembly, it allows users to tune into various radio modes directly within a web browser without the need for native drivers or software installation. The platform features a multi-VFO architecture for simultaneous frequency monitoring, real-time WebGL waterfall displays, and AI-powered live transcription of demodulated audio.
Key features include:
- Multi-VFO support for independent tuning and DSP settings
- High-speed signal processing via Rust and WASM
- Real-time spectrum analysis and GPU-accelerated waterfall display
- Wide demodulation support including WFM, NFM, AM, USB, LSB, DSB, CW, and raw IQ
- Built-in POCSAG decoding and RDS station information retrieval
- Remote access capabilities via WebRTC/PeerJS
Key features include:
- Multi-VFO support for independent tuning and DSP settings
- High-speed signal processing via Rust and WASM
- Real-time spectrum analysis and GPU-accelerated waterfall display
- Wide demodulation support including WFM, NFM, AM, USB, LSB, DSB, CW, and raw IQ
- Built-in POCSAG decoding and RDS station information retrieval
- Remote access capabilities via WebRTC/PeerJS
A curated guide to code sandboxing solutions, covering technologies like MicroVMs, application kernels, language runtimes, and containerization. It provides a feature matrix, in-depth platform profiles (e2b, Daytona, microsandbox, WebContainers, Replit, Cloudflare Workers, Fly.io, Kata Containers), and a decision framework for choosing the right sandboxing solution based on security, performance, workload type, and hosting preferences.
This article details a method for training large language models (LLMs) for code generation using a secure, local WebAssembly-based code interpreter and reinforcement learning with Group Relative Policy Optimization (GRPO). It covers the setup, training process, evaluation, and potential next steps.
A Microsoft engineer demonstrates how WebAssembly modules can run alongside containers in Kubernetes environments, offering benefits like reduced size and faster cold start times for certain workloads.
