4 ms·
> There's nothing wrong with JavaScript, since it can run inside a sandbox. Spectre and Meltdown have shown that there is no such thing as a true sandbox. You'
by rlpb 9y ago
> There's nothing wrong with JavaScript, since it can run inside a sandbox.
Spectre and Meltdown have shown that there is no such thing as a true sandbox. You're always safer not running a sandbox as this way you're safe from the next sandbox breaking vulnerability that already exists but has yet to be discovered.
- amelius 9y ago> Spectre and Meltdown have shown that there is no such thing as a true sandbox. On the Intel platform, perhaps. But that's only because of performance optimizations, so that statement is not universally true.
- pilsetnieks 9y agoMeltdown is Intel only; Spectre is the one that affects most platforms, and is exploitable from Javascript, although it's harder to exploit, and browser makers have deployed fixes.
- ufo 9y agoSpectre can never be trully fixed though. What we have are mitigations.
- amelius 9y agoSpectre is based on branch-prediction and cache memory, see [1]. This means that one obvious way to avoid it is to disable branch-prediction, with a performance loss as a result. Another way would be to separate cache memory between different processes. There are probably more clever ways, but that's just to show that the vulnerability can be avoided. Also, early processors such as 6502 and 8086 didn't have the bug, obviously, but should be capable of running web-browsers if performance is not an issue. [1] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
- falcolas 9y agoSpectre is not Intel specific, and most of the processors immune to spectre attacks also don't run web browsers, making it a irrelevant-to-the-discussion point.
- adrianN 9y agoUntil you can give me a hardware and software stack that has full correctness proofs, including absence of side-channels, I will have to assume that my best course of action is not running untrusted code if it's not absolutely necessary.