3 ms·

My browser process can read plenty of sensitive information and with js and now streaming wasm JIT increasing the attack vector, I’m not so sure I trust the “qu

• Tuna-Fish 9y ago
  The quick fix is pointer poisoning and sanitizing pointers before access. For example, if the code of a JS array does p%arraylength before using p, it makes the spectre 1 vulnerability impossible to exploit. Browsers with JIT engines are also very quickly patched software, and afaict all the major browsers have fast-tracked changes to prevent spectre 1. At this point, spectre 1 is no longer a major threat. In any case, many people are misinformed that disabling speculation is a viable fix. It really isn't -- completely disabling speculation means that every branch has a cost of ~20 cycles and serializes execution around it. Current normal x86 code executes a branch every 5-10 instructions (generally, more when using dynamic languages, less when using static compiled-to-metal languages). Executing branches so often doesn't ruin performance because branch predictor hit rates are >95%, as most of those branches are basically guards, type checks and the like which are almost never taken. Disabling speculation would make modern high-end CPUs spend the vast majority of their time just waiting for the branches to resolve. There is no, and can be no hardware fix to this. The only solution is just to accept that you cannot use a branch alone to protect secret data.