3 ms·

I didn't realize SpiderMonkey was W^X compliant. Does that mean Apple's arguments about third party browser security on iOS are less well-founded than I had bel

by jolux 5y ago

I didn't realize SpiderMonkey was W^X compliant. Does that mean Apple's arguments about third party browser security on iOS are less well-founded than I had believed? My impression was that performant JITs were incompatible with W^X.

voxic11 5y ago
No the issue on ios isn't that W^X is enforced, its that you can't mark a page that was writable as executable (whereas W^X just implies that a page can't be both writable and executable at the same time). Firefox has been W^X compliant by default since 2016 as its considered more secure in general.
- jolux 5y ago
  Ah I see. The iOS restriction makes sense, even though it's more aggressive.
  - jonny_eh 5y ago
    Does it though? They could block all execution for total security.
  - Siira 5y ago
    > makes sense So if it didn’t (have this restriction), you’d be confused as to why? Or are you just praising a high-status decision for being high-status?
floatboth 5y ago
This Dolphin article is literally about making a performant JIT run on an OS that is, among other things, strictly W^X :) > arguments about third party browser security on iOS Well, W^X is just one mitigation technique. But also, the "security" arguments have always been kinda dubious. I don't think there's that much difference (at least philosophically) between an interpreter bug causing arbitrary crap to happen inside your app's sandbox and a JIT bug doing the same.
- jolux 5y ago
  As the sibling comment mentions, apparently the iOS restriction is that you cannot execute pages that have ever been marked as writable, which is much stricter than W^X.