4 ms·
Firefox doesn't yet, but Chrome on desktop fully mitigates spectre using site isolation - every origin (including via embedded iframes, etc) runs in its own pro
by saddlerustle 5y ago
Firefox doesn't yet, but Chrome on desktop fully mitigates spectre using site isolation - every origin (including via embedded iframes, etc) runs in its own process.
- throwaway823882 5y agoFwiw, every time Chrome claims to fix a security problem their own way, somebody finds an exploit in it later.
- zinekeller 5y ago> Chrome on desktop fully mitigates spectre using site isolation Spectre and pals can literally jump between processes that it's no longer funny.
- deleted 5y ago[deleted]
- saddlerustle 5y agoRealistically, only processes that are scheduled on sibling hyperthreads, and hyperthreading can be restricted to processes that have the same privilege level, which is done on ChromeOS. The amount of microarchetectural state that sticks around after a context switch is finite and whenever there's a new avenue found like this, usually easily fixed by ucode update and kernel fix.
- corty 5y ago> easily fixed by ucode update and kernel fix Those microcode updates and kernel fixes are anything but easy. They are anything but lightweight. Context switching overhead is a huge contributor to lag and general inefficiency in interactive systems. Every kind of Spectre mitigation increases that overhead. Every further mitigation wrecks more of the performance advantages that caches have historically provided. From a performance, power consumption and efficiency perspective, Spectre is a disaster. Mitigations just move the problem from a security and privacy one to an efficiency and performance one.
- Geee 5y agoSpectre is attack against that.
- lights0123 5y agoIronically, Firefox has done a better job at following COOP/COEP: right now, it's completely possible in Chrome (until Chrome 91, which isn't stable yet) to read other sites' JS and images without their consent with Spectre.