5 ms·

pc enthusiasts aren’t really into running javascript either.

phpnode 7y ago
I've seen a number of comments like this over the last few days and I don't really get it, gamers use the internet right? Vast overwhelming majority of them are going to be running javascript programs hundreds of times per day
- gameswithgo 7y ago
  sure, and maybe browsers or os need some way to say “running untrusted code please turn off performance for a sec” for that use case. until then ill just use one tab at a time or disable js before i opt in for slow.
  - Wowfunhappy 7y ago
    I expect that the vast majority of PC gamers keep Javascript enabled in their browsers.
    - ChickeNES 7y ago
      CS:GO also uses JS for its new GUI, and there's already been one exploit that took advantage of it.
    - kingosticks 7y ago
      I wouldn't expect that. Is this the kind of thing that would be reported by the Steam hardware survey (if that's still a thing)? Edit: I took a look and it seems they don't ask/record that info. I apologise for the offence this idea seems to have caused someone.
      - zapzupnz 7y ago
        Nobody was offended by the other. I think people are downvoting you and gameswithgo because you appear to be applying your own personal notions to an entire segment with little to no evidence. 'PC enthusiast' is such a blanket term to start with, so applying a blanket statement to such a group is obviously doomed to failure from the very start.
        kingosticks 7y ago
        And that's exactly what the parent did that I replied to. But I do appreciate the explanation, cheers.
      - BubRoss 7y ago
        Why would steam's hardware survey report if JavaScript is enabled in browsers?
        kingosticks 7y ago
        Because its a hardware and software survey. I have a memory of them asking some extra questions but that was years ago. Either I remembered wrong (likely), they changed it, or they don't report it all.
nullandvoid 7y ago
Because downloading and running binaries of applications is much safer? From what i've seen web browser teams have taken the recent risks extremely seriously - I have sure had a worse track record of infection via downloading and installing software versus visiting sites with JS running
- yc12340 7y ago
  > web browser teams have taken the recent risks extremely seriously Not really. They didn't even properly apply band-aids. Chrome and Firefox disabled number of features, that allow Javascript code to create high-precision timers. This makes exploiting slightly more difficult, but the gaping hole is still there — there is infinite number of ways to create a high-precision timer, just not as obvious as closed ones. Chrome has enabled Site Isolation on desktop, but haven't done it on Android (presumably, because of associated increase in memory consumption). All major browsers still allow Javascript to run in background, create CPU threads and consume unrestricted amount of CPU time. I don't believe, that any of them have mounted instruction-based defenses (lfence etc.), but I may be mistaken here.
781 7y ago
Discord is huge in gaming/pc enthusiasts. Oh, and you use VS Code in your stream. I wonder what those two are written in...
- AgentME 7y ago
  Those are bad examples because they both run unsandboxed. The recent CPU vulnerabilities aren't uniquely bad for Javascript specifically. They're bad for wanting to run unprivileged code. Javascript in regular web pages just happens to be the most obvious example of sandboxed code in desktop computers.
CoolGuySteve 7y ago
It would be nice if the mitigations could be applied per-core. Then the OS could set the affinity for processes like games that really don't care.

I've seen a number of comments like this over the last few days and I don't really get it, gamers use the internet right? Vast overwhelming majority of them are going to be running javascript programs hundreds of times per day

gameswithgo 7y ago
sure, and maybe browsers or os need some way to say “running untrusted code please turn off performance for a sec” for that use case. until then ill just use one tab at a time or disable js before i opt in for slow.
- Wowfunhappy 7y ago
  I expect that the vast majority of PC gamers keep Javascript enabled in their browsers.
  - ChickeNES 7y ago
    CS:GO also uses JS for its new GUI, and there's already been one exploit that took advantage of it.
  - kingosticks 7y ago
    I wouldn't expect that. Is this the kind of thing that would be reported by the Steam hardware survey (if that's still a thing)? Edit: I took a look and it seems they don't ask/record that info. I apologise for the offence this idea seems to have caused someone.
    - zapzupnz 7y ago
      Nobody was offended by the other. I think people are downvoting you and gameswithgo because you appear to be applying your own personal notions to an entire segment with little to no evidence. 'PC enthusiast' is such a blanket term to start with, so applying a blanket statement to such a group is obviously doomed to failure from the very start.
      - kingosticks 7y ago
        And that's exactly what the parent did that I replied to. But I do appreciate the explanation, cheers.
    - BubRoss 7y ago
      Why would steam's hardware survey report if JavaScript is enabled in browsers?
      - kingosticks 7y ago
        Because its a hardware and software survey. I have a memory of them asking some extra questions but that was years ago. Either I remembered wrong (likely), they changed it, or they don't report it all.

nullandvoid 7y ago

Because downloading and running binaries of applications is much safer? From what i've seen web browser teams have taken the recent risks extremely seriously - I have sure had a worse track record of infection via downloading and installing software versus visiting sites with JS running

yc12340 7y ago
> web browser teams have taken the recent risks extremely seriously Not really. They didn't even properly apply band-aids. Chrome and Firefox disabled number of features, that allow Javascript code to create high-precision timers. This makes exploiting slightly more difficult, but the gaping hole is still there — there is infinite number of ways to create a high-precision timer, just not as obvious as closed ones. Chrome has enabled Site Isolation on desktop, but haven't done it on Android (presumably, because of associated increase in memory consumption). All major browsers still allow Javascript to run in background, create CPU threads and consume unrestricted amount of CPU time. I don't believe, that any of them have mounted instruction-based defenses (lfence etc.), but I may be mistaken here.

781 7y ago

Discord is huge in gaming/pc enthusiasts. Oh, and you use VS Code in your stream. I wonder what those two are written in...

AgentME 7y ago
Those are bad examples because they both run unsandboxed. The recent CPU vulnerabilities aren't uniquely bad for Javascript specifically. They're bad for wanting to run unprivileged code. Javascript in regular web pages just happens to be the most obvious example of sandboxed code in desktop computers.

CoolGuySteve 7y ago

It would be nice if the mitigations could be applied per-core. Then the OS could set the affinity for processes like games that really don't care.