3 ms·
Isn't it the other way round? Most of these mitigations are to stop hostile code from stealing your secrets. A physical server doesn't run hostile code. A works
by twic 7y ago
Isn't it the other way round? Most of these mitigations are to stop hostile code from stealing your secrets. A physical server doesn't run hostile code. A workstation with a web browser which supports JavaScript runs potentially hostile code all day, every day.
- vbezhenar 7y agoDepends on your browsing pattern. I don't visit random websites often. And even if I do, I don't stick there for long (those exploits need a lot of time to extract useful data). And sites that I visit are trusted (like HN) so they are very unlikely to run exploits.
- arghwhat 7y agoYou run arbitrary code from a lot more sites than you just those you visit, and I doubt you're combing through it. Third-party JS, tracking, unblocked advertisements, possibly malicious on-site code, etc. If you're allowing any site to run JavaScript, you're running entirely arbitrary and uncontrolled code on your machine, and thus is in dire need of the mitigations. It's a different situation for a server designed to not run remote code, which makes it practically impossible to exploit speculative execution vulnerabilities.
- deleted 7y ago[deleted]
- dijit 7y agoSorry, I consider this to be a very poor defence. You might trust the site you go to; but that's not all the javascript that gets loaded, there are includes that a lot of web developers will use for convenience, there are ad networks and there are bugs that could allow some unintended javascript to get loaded (like with bit-squatting[0]). It's not a given that you're safe running javascript if you only visit sites you trust. Even if you are INCREDIBLY sanitary, which I would argue is unrealistic (just check your history and you'll see that you probably visit many sites off of a google search). [0]: http://www.youtube.com/watch?v=lZ8s1JwtNas http://www.youtube.com/watch?v=lZ8s1JwtNas / http://dinaburg.org/bitsquatting.html http://dinaburg.org/bitsquatting.html
- deleted 7y ago[deleted]
- badsectoracula 7y agoSome random server you have control over most likely doesn't run much hostile stuff. But nowadays a HUGE number of "servers" are really cloud-hosted VMs and on those every single thing is hostile from the cloud company's perspective.
- twic 7y agoTrue - i did write physical on purpose!
- badsectoracula 7y agoBut the machines hosting those VMs are physical servers too and i'm certain than gigatexal was including them when he wrote that comment.