3 ms·
Yeah, you have a point -- after all, nobody published any code execution bug in V8 in, like, forever, and by forever I mean in last 6 months. FYI, there have b
by xyzzyz 8y ago
Yeah, you have a point -- after all, nobody published any code execution bug in V8 in, like, forever, and by forever I mean in last 6 months.
FYI, there have been 6 CVEs last year for code execution in V8 only in the last year. Fortunately, Chrome has great sandboxing and mitigation mechanisms to limit the impact of these, the mechanisms the parent explicitly recommends doing away with.
- lachlan-sneff 8y agoWebAssembly is inherently simpler to compile and there is no complex interaction between the runtime and the SIP once compiled, like there is in v8.
- DuskStar 8y agoAnd rowhammer was never a thing either. The point being, when everything is ring 0, you bet on both the hardware and software being perfect. And if there's anything that years of vulnerabilities in cryptographic software has taught me, it's that perfection is REALLY DAMN HARD.