6 ms·

It is that. The author of that blogpost is mentioned in Acknowledgments on the Kaiser whitepaper. :)

by my123 9y ago

userbinator 9y ago
Interesting. I can see it being a concern in shared environments (hence all the cloud providers are quite scared), but unless there's another part about being able to modify kernel memory, IMHO it's not such a big deal for the typical single-user personal computer. I wonder if there are other (non-x86) CPUs that do similar speculative execution affected... the general ideas behind it don't seem to be specific to x86.
- IgorPartola 9y ago
  How so? Letting any old web page read your kernel’s memory seems like kind of a big deal to me. On the other hand I guess remote debugging will be a lot easier in 2018 :)
- Unklejoe 9y ago
  > IMHO it's not such a big deal for the typical single-user personal computer IDK. If this means that some JavaScript from a website can read my kernel's memory, then it seems like a big deal.
  - userbinator 9y ago
    All the more reason to keep JS off by default... ...but the blog post above shows that you need to execute instructions that (try to) access kernel addresses, and have a handler in place to catch the inevitable exception. That doesn't seem like code a JS JIT could generate. You might be thinking of that JS RowHammer demonstration, but that was using regular memory accesses and not with the specific kernel addresses that you need for this.
    - IgorPartola 9y ago
      Sorry that train has left the station. JS is now a part of the web. The advice to keep JS off by default is a lot like saying "turn off your Wi-Fi by default" and "don't use a computer." People that do it occasionally experience an exaggerated sense of smugness when a particularly nasty bug is discovered, but then they go back to leading a much more difficult online life than the rest of the world.
      - userbinator 9y ago
        No, it's only because of "JS is now a part of the web" advocates that we've gotten into this horrible situation. but then they go back to leading a much more difficult online life than the rest of the world. I completely disagree, because I don't have to routinely subject myself to the barrage of useless distracting noise (adverts and whatever else) caused by JS. https://news.ycombinator.com/item?id=10871967 https://news.ycombinator.com/item?id=10871967 (The rest of the comments on that item are worth reading too.) Also, "JS off" is very much in agreement with "don't run untrusted code", something which everyone who cares about security in any way would have no problem with.
        IgorPartola 9y ago
        I care about security and I do have a problem with it. http://www.logicalfallacies.info/presumption/no-true-scotsman/ http://www.logicalfallacies.info/presumption/no-true-scotsma... Yes I advocate for JS to be a part of the web. There are good reasons for it. But regardless, it has nothing to with advocates. We are in this situation because browser vendors included JS and developers and users found it useful. Again, you are free to deny the idea that this is irreversible, but I am with the 99.99% of users of the web who have JS enabled. Edit: QoL is subjective of course, but let me ask you this: when was the last time you really had JS enabled by default and how did you measure the trade off? My suspicion is that most people who put on their tin foil hat^W^W^W^W^W^Wturn off JS by default don't actually turn it back on frequently, and spend a whole lot of their lives fiddling with drop down menus to enable/disable JS on specific sites.
        zzzcpan 9y ago
    - rbetts 9y ago
      Classic HN

It is that. The author of that blogpost is mentioned in Acknowledgments on the Kaiser whitepaper. :)

by my123 9y ago

It is that. The author of that blogpost is mentioned in Acknowledgments on the Kaiser whitepaper. :)

Interesting. I can see it being a concern in shared environments (hence all the cloud providers are quite scared), but unless there's another part about being able to modify kernel memory, IMHO it's not such a big deal for the typical single-user personal computer. I wonder if there are other (non-x86) CPUs that do similar speculative execution affected... the general ideas behind it don't seem to be specific to x86.

IgorPartola 9y ago
How so? Letting any old web page read your kernel’s memory seems like kind of a big deal to me. On the other hand I guess remote debugging will be a lot easier in 2018 :)
Unklejoe 9y ago
> IMHO it's not such a big deal for the typical single-user personal computer IDK. If this means that some JavaScript from a website can read my kernel's memory, then it seems like a big deal.
- userbinator 9y ago
  All the more reason to keep JS off by default... ...but the blog post above shows that you need to execute instructions that (try to) access kernel addresses, and have a handler in place to catch the inevitable exception. That doesn't seem like code a JS JIT could generate. You might be thinking of that JS RowHammer demonstration, but that was using regular memory accesses and not with the specific kernel addresses that you need for this.
  - IgorPartola 9y ago
    Sorry that train has left the station. JS is now a part of the web. The advice to keep JS off by default is a lot like saying "turn off your Wi-Fi by default" and "don't use a computer." People that do it occasionally experience an exaggerated sense of smugness when a particularly nasty bug is discovered, but then they go back to leading a much more difficult online life than the rest of the world.
    - userbinator 9y ago
      No, it's only because of "JS is now a part of the web" advocates that we've gotten into this horrible situation. but then they go back to leading a much more difficult online life than the rest of the world. I completely disagree, because I don't have to routinely subject myself to the barrage of useless distracting noise (adverts and whatever else) caused by JS. https://news.ycombinator.com/item?id=10871967 https://news.ycombinator.com/item?id=10871967 (The rest of the comments on that item are worth reading too.) Also, "JS off" is very much in agreement with "don't run untrusted code", something which everyone who cares about security in any way would have no problem with.
      - IgorPartola 9y ago
        I care about security and I do have a problem with it. http://www.logicalfallacies.info/presumption/no-true-scotsman/ http://www.logicalfallacies.info/presumption/no-true-scotsma... Yes I advocate for JS to be a part of the web. There are good reasons for it. But regardless, it has nothing to with advocates. We are in this situation because browser vendors included JS and developers and users found it useful. Again, you are free to deny the idea that this is irreversible, but I am with the 99.99% of users of the web who have JS enabled. Edit: QoL is subjective of course, but let me ask you this: when was the last time you really had JS enabled by default and how did you measure the trade off? My suspicion is that most people who put on their tin foil hat^W^W^W^W^W^Wturn off JS by default don't actually turn it back on frequently, and spend a whole lot of their lives fiddling with drop down menus to enable/disable JS on specific sites.
        zzzcpan 9y ago
  - rbetts 9y ago
    Classic HN