4 ms·
> "just don't run bad JS code". It's not workable. A little NoScript goes a long way. At least that way you can pick what you want to run.
by Shared404 6y ago
> "just don't run bad JS code". It's not workable.
A little NoScript goes a long way. At least that way you can pick what you want to run.
- stefan_ 6y agoOh yes, if you ask me, throw this JIT shit out. Whats the spectre rate like if you need to do it through slow as molasses bytecode? 1b/minute?
- monocasa 6y agoIt's not the JIT that's the issue, but a deeper problem. It's untrusted instruction streams which.you can get from just untrusted data too. Netspectre was able to dump kernel memory just from untrusted received network packets, no jit required.
- xiphias2 6y agoIt seems to me like timers and multi-threading make these things possible, so why couldn't the web site ask for access for those resources from the user? Most web sites don't need these. HN should work without reading timers at all for example.