3 ms·
Your desktop PC is regularly running largely unverified code, some of it potentially hostile: all the javascript in your browser.
by x0x0 7y ago
Your desktop PC is regularly running largely unverified code, some of it potentially hostile: all the javascript in your browser.
- cosarara 7y agoBrowsers have mitigations in place, don't they? Aren't they enough, at least on paper?
- mikedelfino 7y agoI can't provide proper citations right now but there has been working exploits of some the latest CPU bugs using just Javascript in a browser as if we're browsing regular websites.
- cosarara 7y agoIf you could provide citations at some other time that would be great!
- SAI_Peregrinus 7y agoNot if hyperthreading is enabled. The point is that it's a hardware flaw, so any software mitigations can be bypassed.
- cosarara 7y agoIs there a PoC exploit for current firefox that would work if I set mitigations=off and enable HT on linux, for instance?
- diegoperini 7y agoLol, amount of untrusted dll injections to mod, by default, unmoddable games; 3rd party VR tools and drivers; video and audio multiplexer drivers; compatibility drivers for normally unsupported console cameras/controllers etc; ultra demanding last gen console emulators; macro tools that are essentialy keyloggers; anti-cheat daemons running as admin to read memory of other processes; Windows gaming is wild! I literally sell my soul to gain a few more fps or immersion. Browser js looks almost too innocent in this whole mess.
- favorited 7y agoExcept most users aren't modding their PC games. Every user runs untrusted Javascript. If someone is patching DLLs they can figure out how to enable hyperthreading.