4 ms·

Built-in functions currently consume 700 KB in each Isolate (an Isolate roughly corresponds to a browser tab in Chrome). This is quite wasteful, and last year w

by shawn 8y ago

Built-in functions currently consume 700 KB in each Isolate (an Isolate roughly corresponds to a browser tab in Chrome). This is quite wasteful, and last year we began working on reducing this overhead. In V8 v6.4, we shipped lazy deserialization, ensuring that each Isolate only pays for the built-ins that it actually needs (but each Isolate still had its own copy). Also known as Autoload. What’s old is new again... http://www.gnu.org/software/emacs/manual/html_node/elisp/Autoload.html http://www.gnu.org/software/emacs/manual/html_node/elisp/Aut... Embedded built-ins go one step further. An embedded built-in is shared by all Isolates, and embedded into the binary itself instead of copied onto the JavaScript heap. This means that built-ins exist in memory only once regardless of how many Isolates are running, an especially useful property now that Site Isolation has been enabled by default. Inb4 security vuln in a builtin is used to pivot across tabs or reveal state in other tabs. Like, say, a timing attack on regex exec to reveal whether the word “Facebook” appears in some other tab. </baseless>

vorpalhex 8y ago
Since you're obviously a savant, it's curious that you don't simply contribute to v8 development given that it's open source.
- shawn 8y ago
  They’ll have to wait in line. My time is far too valuable to give it away. I have tremendous things to accomplish. Actually, I would be surprised if a vuln creeps its way into a builtin. Most of the runtime should be stateless, and regex exec was the only one I could think of that might do some fancy memoization. But I hear it’s fun to collect a paycheck at pwn2own.
- slimsag 8y ago
  I love WebAssembly and I don't agree with GP at all here, but this prevailing holier-than-thou attitude of "You shouldn't complain or poke holes in things unless you're willing to fix them yourself" is just silly, so I down-voted you. Trying to poke holes in things, or raising concerns about them, is contributing. I would rather hear other people's arguments (even if I don't agree with them) than silence them on the grounds of "let's see you do better n00b".
- Avamander 8y ago
  Could we please drop this "if you see a problem just contribute" and switch to "if you can contribute then please do"? I have a feeling that this is a common way in the OSS community to dismiss suggestions, ideas and criticism instead of taking them into account, feel free to correct me if this isn't the case. EDIT: Seems I'm not the only one that's annoyed by this.
- dang 8y ago
  Personal attacks will get you banned here. Please post civilly and substantively, or not at all. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
dividuum 8y ago
> Inb4 security vuln in a builtin is used to pivot across tabs or reveal state in other tabs. Although I don't know all the internals of how chrome isolates tabs, I'm not sure how that's supposed to happen. If I understand the original approach correctly, it just means that the code is in the original binary, paged in once and using copy-on-write semantics while forking individual sandbox processes only exists as a single copy instead of multiple copies that would happen if the code somehow has to be prepared by "copying to the JS heap" of each individual sandbox process.
- gsnedders 8y ago
  Yes, this is my understanding of the implementation.
oscargrouch 8y ago
Is this even possible? Its just read-only machine code, theres no stack data for instance from the last executions that you can watch for. Maybe only if you know when the code is being executed, in which register that particular builtin write the memory address of the payload, and then go for the payload on the heap to see what's there. To know when the code will be executed you would need to watch for the VM loop and to when that particular builtin you are interested in its on the 'execution needle'.. But to get there you would first need to find a exploit, with arbitrary code execution, where you can upload your exploit payload to hook on the VM loop (and this sounds a lot of work to me). (Not a Sec. guy myself, so genuinely curious how this could be done, but trying to figure out a way to exploit this, i kind of begin to see how it could be done)

by shawn 8y ago

vorpalhex 8y ago

Since you're obviously a savant, it's curious that you don't simply contribute to v8 development given that it's open source.

shawn 8y ago
They’ll have to wait in line. My time is far too valuable to give it away. I have tremendous things to accomplish. Actually, I would be surprised if a vuln creeps its way into a builtin. Most of the runtime should be stateless, and regex exec was the only one I could think of that might do some fancy memoization. But I hear it’s fun to collect a paycheck at pwn2own.
slimsag 8y ago
I love WebAssembly and I don't agree with GP at all here, but this prevailing holier-than-thou attitude of "You shouldn't complain or poke holes in things unless you're willing to fix them yourself" is just silly, so I down-voted you. Trying to poke holes in things, or raising concerns about them, is contributing. I would rather hear other people's arguments (even if I don't agree with them) than silence them on the grounds of "let's see you do better n00b".
Avamander 8y ago
Could we please drop this "if you see a problem just contribute" and switch to "if you can contribute then please do"? I have a feeling that this is a common way in the OSS community to dismiss suggestions, ideas and criticism instead of taking them into account, feel free to correct me if this isn't the case. EDIT: Seems I'm not the only one that's annoyed by this.
dang 8y ago
Personal attacks will get you banned here. Please post civilly and substantively, or not at all. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

dividuum 8y ago

> Inb4 security vuln in a builtin is used to pivot across tabs or reveal state in other tabs. Although I don't know all the internals of how chrome isolates tabs, I'm not sure how that's supposed to happen. If I understand the original approach correctly, it just means that the code is in the original binary, paged in once and using copy-on-write semantics while forking individual sandbox processes only exists as a single copy instead of multiple copies that would happen if the code somehow has to be prepared by "copying to the JS heap" of each individual sandbox process.

gsnedders 8y ago
Yes, this is my understanding of the implementation.

oscargrouch 8y ago

Is this even possible? Its just read-only machine code, theres no stack data for instance from the last executions that you can watch for. Maybe only if you know when the code is being executed, in which register that particular builtin write the memory address of the payload, and then go for the payload on the heap to see what's there. To know when the code will be executed you would need to watch for the VM loop and to when that particular builtin you are interested in its on the 'execution needle'.. But to get there you would first need to find a exploit, with arbitrary code execution, where you can upload your exploit payload to hook on the VM loop (and this sounds a lot of work to me). (Not a Sec. guy myself, so genuinely curious how this could be done, but trying to figure out a way to exploit this, i kind of begin to see how it could be done)