3 ms·

That was extremely quick. Did they have this paper up their sleeve, expecting browsers to implement these kind of mitigation?

by nostoc 9y ago

jhatax 9y ago
OP here. I didn’t write the paper, but had goose bumps (in a scared, WTF kinda way) after reading through it. Thanks for the comments so far... I got the link to this paper from Luke Wagner’s post [1] on Mozilla’s Security blog regarding Spectre, and migrations being implemented in Firefox. I had a strong sense of foreboding after reading both the post and the linked PDF for a few reasons: 1. The overall tone of the post is pretty dour because a veritable Pandora’s box has been opened by these findings. 2. The team doesn’t really know how to fix the issues surfaced without performance penalties. 3. Not every attack vector is known to the research and browser development community! 4. Firefox (and other browser vendors) strongly believes that the web as a platform holds a great deal of promise. For this to become a reality, browsers need to perform close to native speeds. High fidelity timers are deemed pivotal to the performance equation even though they risk the overall security of the system. This is why Luke and team are going to invest heavily in fixing these issues as they are reported. This last point is key, and it surfaces the inherent Catch-22 faced by browser vendors. They need to balance performance and security considerations for the web platform to succeed. And right now, security is being sacrificed at the altar of performance. This brings me to the question that I have been noodling over all week long: Is the notion of the “web as a platform” an anachronism? Can we ditch this idea because native apps have won? More insightful and influential folks in the HN community should chime in here with their perspectives. 1. https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... Edit: light wordsmithing
- pjmlp 9y ago
  Personally I am betting my horse on the native side. My web development projects were a pleasure back when it was all about HTML/CSS instead of trying to duplicate an OS.

That was extremely quick. Did they have this paper up their sleeve, expecting browsers to implement these kind of mitigation?

by nostoc 9y ago

That was extremely quick. Did they have this paper up their sleeve, expecting browsers to implement these kind of mitigation?

jhatax 9y ago

OP here. I didn’t write the paper, but had goose bumps (in a scared, WTF kinda way) after reading through it. Thanks for the comments so far... I got the link to this paper from Luke Wagner’s post [1] on Mozilla’s Security blog regarding Spectre, and migrations being implemented in Firefox. I had a strong sense of foreboding after reading both the post and the linked PDF for a few reasons: 1. The overall tone of the post is pretty dour because a veritable Pandora’s box has been opened by these findings. 2. The team doesn’t really know how to fix the issues surfaced without performance penalties. 3. Not every attack vector is known to the research and browser development community! 4. Firefox (and other browser vendors) strongly believes that the web as a platform holds a great deal of promise. For this to become a reality, browsers need to perform close to native speeds. High fidelity timers are deemed pivotal to the performance equation even though they risk the overall security of the system. This is why Luke and team are going to invest heavily in fixing these issues as they are reported. This last point is key, and it surfaces the inherent Catch-22 faced by browser vendors. They need to balance performance and security considerations for the web platform to succeed. And right now, security is being sacrificed at the altar of performance. This brings me to the question that I have been noodling over all week long: Is the notion of the “web as a platform” an anachronism? Can we ditch this idea because native apps have won? More insightful and influential folks in the HN community should chime in here with their perspectives. 1. https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... Edit: light wordsmithing

pjmlp 9y ago
Personally I am betting my horse on the native side. My web development projects were a pleasure back when it was all about HTML/CSS instead of trying to duplicate an OS.