3 ms·
Considering the recent "Spectre is here to stay" paper [1], can anyone comment on whether Firefox should be considered secure until the work on process-per-site
by benol 8y ago
Considering the recent "Spectre is here to stay" paper [1], can anyone comment on whether Firefox should be considered secure until the work on process-per-site lands (I believe they are working on it)?
[1] https://arxiv.org/abs/1902.05178 https://arxiv.org/abs/1902.05178
- hannob 8y ago> can anyone comment on whether Firefox should be considered secure until the work on process-per-site lands No and Yes. No, theoretically there could be spectre vulns. Practically we have seen zero spectre-based attacks in the wild. It's not a big deal.
- deleted 8y ago[deleted]
- pcwalton 8y agoWe don't see Spectre vulnerabilities in the wild, and in any case Firefox has mitigations for it such as lowering timer resolution. The ongoing Fission work is basically defense in depth against future potential Spectre-like vulnerabilities.