3 ms·

> Software-isolated processes Is it true that this idea is dead nowadays, because of Spectre-style attacks?

• sshb 5y ago
  Isn't eBPF basically the same idea?
  • jssmith 5y ago
    Yes, but it is more restrictive, e.g., it is not Turing complete. I’m not sure whether this directly addresses Spectre risks though. An analysis of Spectre and software isolation is here: https://arxiv.org/abs/1902.05178 https://arxiv.org/abs/1902.05178
• dreamcompiler 5y ago
  It has nothing to do with Spectre. Spectre exploits Intel's (and tbf others') mistake of changing the processor's global state when speculatively executing code. Intel could fix it either by always checking permissions before spec-ex, or by transactionally rolling back all global state changes (e.g. cache lines) when permission failures are detected. Edit: I misunderstood your question. Yes, Spectre cannot be fixed with software. But if Spectre were fixed in hardware (as it must be in new designs), software process isolation could still work barring new undiscovered hardware vulnerabilities.