4 ms·

I may be wrong about this, and about specifically how exposed browsers are to Spectre, but the only real mitigation here, since protected memory can be accessed

I may be wrong about this, and about specifically how exposed browsers are to Spectre, but the only real mitigation here, since protected memory can be accessed through the same mechanism, is disabling branch prediction and CPU caches, or barring those caches being reused across threads or execution contexts. Or completely redesigning those aspects of CPU behavior to remove the ability for similar timing attacks.

swiley 6y ago
Or just not accepting and evaling arbitrary code from every single website the user visits, including ones that should only be static documents or forms. That this is generally considered ok boggles the mind. That browser vendors have made it difficult for users to disable this is insane! Even MS Internet Explorer gave users at least that security tool!
- emilsedgh 6y ago
  the modern web doesn't work without Javascript. It's as simple as that. People like you who want to turn js off are a very small niche. And you have better solutions. Run your browser in a remote server using rdp or vnc. I think it may be equally safe and you may actually have a larger chunk of web working for you.
  - paulryanrogers 6y ago
    Considering the increasing sandboxing and protections I think we're getting closer to browsers in VMs already. Someday I can see a permission prompt to allow performance sensitive sites lower level access.
  - astrobe_ 6y ago
    The "modern web" does not want to work without JS. It definitely could work without JS for the most part.
    - afavour 6y ago
      I don’t know about that. Google Maps (or any “slippy” map) couldn’t work. Instant messaging couldn’t work. Video chat wouldn’t work. Rich document editing wouldn’t work. I get that some people would like that because they think all those things belong in native apps, but that’s not where the “modern web” is today.
      - astrobe_ 6y ago
        If we didn't complain about Java applets, we still would have Java applets. If we didn't complain about Flash, we still would have Flash applets. Yesterday there was however people that were saying, "that's how it is, deal with it" or "But, but... Without it we can't have this and that" or "The ship has sailed, get over it". Today, we have reasons to complain about JS. Yes, it enhances interactivity, but it also abused. There's a lot of unwanted interactivity (the type of one-way interactivity that lets a server know more than necessary about their clients).
  - swiley 6y ago
    Note that I limited what I was talking about to static documents and forms. Executable code should be a permission the page has to explicitly request from the user like notifications and microphones.
- paulryanrogers 6y ago
  Chrome desktop does actually allow you to run with JS disabled and allow per site with only a few clicks.
  - postalrat 6y ago
    Not only that but google search, gmail, and other google services will still workout without javascript.
Tuna-Fish 6y ago
No. Process isolation still works, assuming your CPU is not broken. The real mitigation is that going forwards, you have to assume that any attacker-controlled code always has full read access to the entire process it runs in, and you need to architect your systems so that this does not result in any bad things. It is entirely possible to do this. You can still have branch prediction and caches, which is a very good thing, because not having those would cut the performance of modern CPUs to less than 1% of what it currently is.

swiley 6y ago

Or just not accepting and evaling arbitrary code from every single website the user visits, including ones that should only be static documents or forms. That this is generally considered ok boggles the mind. That browser vendors have made it difficult for users to disable this is insane! Even MS Internet Explorer gave users at least that security tool!

emilsedgh 6y ago
the modern web doesn't work without Javascript. It's as simple as that. People like you who want to turn js off are a very small niche. And you have better solutions. Run your browser in a remote server using rdp or vnc. I think it may be equally safe and you may actually have a larger chunk of web working for you.
- paulryanrogers 6y ago
  Considering the increasing sandboxing and protections I think we're getting closer to browsers in VMs already. Someday I can see a permission prompt to allow performance sensitive sites lower level access.
- astrobe_ 6y ago
  The "modern web" does not want to work without JS. It definitely could work without JS for the most part.
  - afavour 6y ago
    I don’t know about that. Google Maps (or any “slippy” map) couldn’t work. Instant messaging couldn’t work. Video chat wouldn’t work. Rich document editing wouldn’t work. I get that some people would like that because they think all those things belong in native apps, but that’s not where the “modern web” is today.
    - astrobe_ 6y ago
      If we didn't complain about Java applets, we still would have Java applets. If we didn't complain about Flash, we still would have Flash applets. Yesterday there was however people that were saying, "that's how it is, deal with it" or "But, but... Without it we can't have this and that" or "The ship has sailed, get over it". Today, we have reasons to complain about JS. Yes, it enhances interactivity, but it also abused. There's a lot of unwanted interactivity (the type of one-way interactivity that lets a server know more than necessary about their clients).
- swiley 6y ago
  Note that I limited what I was talking about to static documents and forms. Executable code should be a permission the page has to explicitly request from the user like notifications and microphones.
paulryanrogers 6y ago
Chrome desktop does actually allow you to run with JS disabled and allow per site with only a few clicks.
- postalrat 6y ago
  Not only that but google search, gmail, and other google services will still workout without javascript.

Tuna-Fish 6y ago

No. Process isolation still works, assuming your CPU is not broken. The real mitigation is that going forwards, you have to assume that any attacker-controlled code always has full read access to the entire process it runs in, and you need to architect your systems so that this does not result in any bad things. It is entirely possible to do this. You can still have branch prediction and caches, which is a very good thing, because not having those would cut the performance of modern CPUs to less than 1% of what it currently is.