3 ms·
"The hard truth is that if this code was written in JavaScript, it wouldn’t have been vulnerable." I'd be very, very careful making broad "interpreted language
by al2o3cr 11y ago
"The hard truth is that if this code was written in JavaScript, it wouldn’t have been vulnerable."
I'd be very, very careful making broad "interpreted language X would prevent this bug" statements - not only is it dependent on the VM not having remotely-exploitable issues, there's also the matter of VM-to-host leakage. For instance, it's possible to exploit the row-hammer behavior of the host system's DRAM from Javascript:
https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs
- dakami 11y agoNo argument from me about the seriousness of issues like Rowhammer. Computers are built in layers, and layers require reduction to logical assumptions. The degree to which Rowhammer destroys logical assumptions is astonishing. However, we've got lots and lots of common flaws that our present coding patterns aren't quite covering. This exact code written in JS wouldn't have been a problem. It wouldn't have been a problem even if it was just transpiled to JS and kept in a well defined sandbox (which isn't how we're doing sandboxing right now).