3 ms·
This is somewhere between misleading and wrong -- Spectre-ish attacks can be conducted by JavaScript when you visit a random web page. It's mostly appropriatel
by cjbprime 7y ago
This is somewhere between misleading and wrong -- Spectre-ish attacks can be conducted by JavaScript when you visit a random web page. It's mostly appropriately-proportioned.
- inetknght 7y agoWhat is JavaScript except code being remotely executed?
- cjbprime 7y agoIt's code being executed in a well-tested sandbox that should not be able to steal your machine's secrets, so it's appropriate to freak out over the fact that these attacks allowed it to do that.
- inetknght 7y agoIt's code that can run for arbitrary amounts which can't be killed without killing the browser and affecting _other_ services to. It's user hostile code executed by foreign entities on devices that you are supposed to "own"
- cjbprime 7y agoIn recent browsers you can certainly kill just one tab's JavaScript without taking out anything else. It doesn't feel very different to printing a PostScript file to me. You're giving someone access to run their "arbitrary code" in a VM on your system with very limited permissions.