WebAssembly (WASM) & WASI

In one line

WebAssembly is a compact binary instruction format that runs at near-native speed inside a strict sandbox; WASI extends it beyond the browser with capability-based access to files, clocks and sockets — code can only touch what you explicitly hand it.

The problem it solves

Two old problems at once: the browser could only run JavaScript (slow for heavy compute), and running untrusted code anywhere is dangerous. WebAssembly answers both — a portable binary that runs at near-native speed inside a strict sandbox, so you can ship a C/Rust algorithm to a browser and run code you don't fully trust without it escaping.

How it works

• Compile C/C++/Rust/Go (or transpile higher-level languages) to a .wasm module; any compliant runtime executes it — browsers, Node, or standalone runtimes (Wasmtime, Wasmer).
• Isolation by design — memory is linear and sandboxed; there are no ambient privileges. A module can't reach the network or filesystem unless explicitly granted.
• WASI inverts the default — instead of "code can do anything unless confined," a module receives explicit handles (this directory, this socket) and nothing else: capability-based security.

This is exactly why this site's Python labs run on WebAssembly (Pyodide) — real Python, in the browser, sandboxed.

Where it shows up in digital health

• Heavy compute in the browser, no install — DICOM decoding, signal processing, even small NLP models.
• Server-side safe execution of untrusted code — plugin systems and per-user lab sandboxes where a misbehaving module simply cannot reach the database.

That capability-security story is why WASM/WASI is a candidate for this platform's lab-isolation layer.

Common pitfalls

• Assuming "sandboxed" = "harmless" — a sandbox limits reach, not resource abuse (CPU/memory DoS still needs limits).
• DOM/JS interop overhead — crossing the WASM↔JS boundary frequently can erase the speed win; batch the calls.
• Big modules — .wasm payloads can be large; lazy-load and cache.

Key takeaways

• WASM = portable, near-native, sandboxed binary that runs in browsers and servers.
• No ambient privileges; WASI grants explicit capabilities only (this dir, this socket).
• Powers in-browser heavy compute (the Python labs) and safe untrusted-code execution.
• A strong candidate for sandboxing user code in labs — security by construction.