3 ms·

So a quick question. What is the alternative to SharedArrayBuffer? One of the web applications i work on use it a fair amount. Is our app now just going to brea

So a quick question. What is the alternative to SharedArrayBuffer? One of the web applications i work on use it a fair amount. Is our app now just going to break?

oneweekwonder 9y ago
The feature was previously hidden behind a about:config option[0]. Not a ff user but might check if it is back and for now let your users now? Is chrome or edge affected? Should the SharedArrayBuffer mdn page be updated; or maybe moz://a will fix it quickly enough to allow it on by default again. By the looks of it, this will affect a lot of webgl code. [0]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer#compatNote_2 https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- tedivm 9y ago
  Chrome will be taking the same steps- > In line with other browsers, Chrome 64 will disable SharedArrayBuffer and modify the behaviour of other APIs such as performance.now, to help reduce the efficacy of speculative side-channel attacks. This is a temporary measure until other mitigations are in place. https://sites.google.com/a/chromium.org/dev/Home/chromium-security/ssca https://sites.google.com/a/chromium.org/dev/Home/chromium-se...
tkone 9y ago
The window.postMessage and related MessageChannel APIs. You have to set up a listener and then post a message across the "boundary" (like an iframe or webworker).
alangpierce 9y ago
The phrasing in the post says "The SharedArrayBuffer feature is being disabled by default", so depending on your situation, you may be able to instruct your users to manually enable it, or you can at least enable it yourself to continue development in the meantime. Of course, that will likely be a browser-wide setting, so telling others to enable it will put them more at risk of these attacks. (As mentioned in another comment, the more robust solution is to use window.postMessage as a fallback, although it depends on exactly what you're doing.)

So a quick question. What is the alternative to SharedArrayBuffer? One of the web applications i work on use it a fair amount. Is our app now just going to break?

oneweekwonder 9y ago

The feature was previously hidden behind a about:config option[0]. Not a ff user but might check if it is back and for now let your users now? Is chrome or edge affected? Should the SharedArrayBuffer mdn page be updated; or maybe moz://a will fix it quickly enough to allow it on by default again. By the looks of it, this will affect a lot of webgl code. [0]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer#compatNote_2 https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

tedivm 9y ago
Chrome will be taking the same steps- > In line with other browsers, Chrome 64 will disable SharedArrayBuffer and modify the behaviour of other APIs such as performance.now, to help reduce the efficacy of speculative side-channel attacks. This is a temporary measure until other mitigations are in place. https://sites.google.com/a/chromium.org/dev/Home/chromium-security/ssca https://sites.google.com/a/chromium.org/dev/Home/chromium-se...

tkone 9y ago

The window.postMessage and related MessageChannel APIs. You have to set up a listener and then post a message across the "boundary" (like an iframe or webworker).

alangpierce 9y ago

The phrasing in the post says "The SharedArrayBuffer feature is being disabled by default", so depending on your situation, you may be able to instruct your users to manually enable it, or you can at least enable it yourself to continue development in the meantime. Of course, that will likely be a browser-wide setting, so telling others to enable it will put them more at risk of these attacks. (As mentioned in another comment, the more robust solution is to use window.postMessage as a fallback, although it depends on exactly what you're doing.)