On: 5x faster Edge Functions: V8 isolates to Firecracker MicroVMs

[CodesInChaos]

> When the MicroVM boots up and the JavaScript server begins to listen on a port, we take a snapshot of the MicroVM. [...] we start a new MicroVM from that snapshot.

That sounds scary, since forked RNG states can lead to catastrophic failures in UUID generators or cryptography.

[ameliaquining → CodesInChaos]

Firecracker has existing solutions to this, which I assume they're using: https://github.com/firecracker-microvm/firecracker/blob/main...

[tybit → ameliaquining]

You’d hope so, though it’s not unheard of to get this wrong. Fastly managed to snapshot guest seeds and use them at runtime for RNG in their WASM snapshots a few years ago https://nvd.nist.gov/vuln/detail/cve-2022-39218

[CodesInChaos → ameliaquining]

The problem is that this can not not only happen in the kernel, but in any use mode application or library.