How to build a plugin system on the web and also sleep well at night (figma.com)

Article summary

The article discusses Figma's approach to building a plugin system, focusing on security, stability, and performance. The company initially considered using iframes as a sandboxing solution but encountered issues with async/await and copying large documents. They then explored alternative approaches, including compiling a JavaScript interpreter to WebAssembly and using Realms. The article highlights the challenges and trade-offs involved in designing a plugin system for a web-based application.

Main themes

• plugin systems
• security
• sandboxing
• WebAssembly
• Realms
• extensibility

What commenters say

• Figma's plugin system is a significant improvement over traditional approaches, offering a more secure and stable way to run third-party code.
• The use of iframes as a sandboxing solution is not viable for large documents and complex applications.
• Open-sourcing security-sensitive components, such as the Realm-shim, could benefit the community and improve overall security.
• Some companies may be hesitant to open-source their proprietary technology, even if it could benefit others, due to competitive concerns.
• Security should be a standard practice and not a competitive advantage, and companies should share knowledge and technology to improve overall security.
• Different approaches to plugin systems, such as using iframes or WebAssembly, have their own strengths and weaknesses, and the best approach depends on the specific use case and requirements.
• The development of plugin systems is an ongoing challenge, and companies are still exploring and refining their approaches to achieve the right balance between security, stability, and performance.