feat(core-api): read-only and distortion proxies of plugins

Description

As a Cactus operator I want to have safety measures in place when importing a plugin, ensuring that if said plugin turns out to be malicious it will not be able to steal sensitive information from other plugins such as private keys used by a validator plugin for example so that I can have peace of mind (or at least a little less anxiety) about installing new plugins to my Cactus deployment.

https://github.com/salesforce/observable-membrane

Acceptance Criteria

1. A test case showing two plugins having only read-only access to each other’s read-only properties
2. Test case for distortion where dummy malicious plugin tries to access the privateKeyHex property of some other plugin instnace that it acquired through the plugin registry and failing (e.g. distortion ensures real private key is hidden and the proxy accessor returned some garbage instead).

cc: @cliveb @jonathan-m-hamilton @takeutak @sfuji822

[petermetz]

@erights @cliveb @kumavis Thank you all, it’s starting to make a lot more sense now big-picture wise. This will help me a lot once I get started up on this task again (currently neck deep in another one).

Welcome to your new favorite rabbit hole rabbit2

Definitely made me chuckle. 😃 Can’t go back up now… gotta go deeper! 😃

[kumavis]

Hello/ author of LavaMoat here I think the observable-membrane package is not built to be secure. I looked at it when building my membrane implementation Cytoplasm https://github.com/LavaMoat/cytoplasm However I ultimately abandoned it due to severe performance impact (I’ve seen 300x slowdown) and some other design issues Membranes are really neat but I’ve lost some hope on their practicality.

That said, I think you can get a lot of security without them by using SES. Welcome to your new favorite rabbit hole 🐇