3 ms·
This is clarified later: “Spectre means that branches are no longer sufficient for enforcing the security properties of read operations in WebKit.“ It’s totall
by pizlonator 9y ago
This is clarified later: “Spectre means that branches are no longer sufficient for enforcing the security properties of read operations in WebKit.“
It’s totally true that Spectre allows attackers to control reads, but when they do this, they enter a non-destructive execution mode. They can read but anything they write is thrown away. (To our knowledge, lol.)
- 0x7f 9y agoThank you for clarifying, that what I thought. Still I find that the article is not clear enough on this point, I fell that some people will read this as "OMG they can control execution remotely, this the apocalypse". I mean to an extent yes, but the results are dropped like you said and the main execution path shouldn't be affected. It only facilitate information leaks AFAIK.