3 ms·
Seems like virtualization is the way to go for JavaScript. Hypervisors such as XEN in HVM mode with modern processors don’t result in a large performance penalt
by ec109685 9y ago
Seems like virtualization is the way to go for JavaScript. Hypervisors such as XEN in HVM mode with modern processors don’t result in a large performance penalty, so I imagine Chrome will gravitate towards it for running untrusted code.
- pcwalton 9y agoIf running JS (that can access the DOM) in a separate process from the renderer were feasible, browsers would have done it long ago.
- devit 9y agoYou just need to run it in a process without any secret data from other origins or the browser/system. That seems feasible without significant performance loss in most cases. There is still a fingerprinting issue though that might not be possible to fully remove without huge performance cost.
- contrarian_ 9y agoProcess isolation does not prevent Spectre. In theory, you can carry out Spectre over the network.
- pcwalton 9y agoThat's what Site Isolation is, but it has significant drawbacks: it cannot always protect against cross origin cookie leakage, and pages can have a lot more cross domain iframes than a reasonable process limit can account for.