3 ms·

Um, how concerned should I be about this? Is it time to turn off javascript in the browser? And if it is, is this not the End Times for browser distributed soft

Um, how concerned should I be about this? Is it time to turn off javascript in the browser? And if it is, is this not the End Times for browser distributed software? I ask because sometimes you need to ask if it's really the end of the world or just Monday.

Terr_ 5y ago
> Is it time to turn off javascript in the browser? I've been browsing with Javascript off-by-default for years and recommend it regardless. Sure, perhaps a site I trusted and whitelisted will try to hack me, but I feel it's far less likely than some random typo-squatting site or advertising-broker logic.
egberts1 5y ago
JavaScript, despite compiler hardening, is still subjectable to SPECTRE-like actions. It’s in the compilers’ mitigation effort and CPU memory controllers both. Something about CPU firmware and its inability to fix some aspect of memory bank controllers.
pas 5y ago
It depends on how concerned are you about the regular security issues. Which ideally depends on the things you are responsible for. If it's your family photos in iCloud? Nah. If it's the nuclear launch codes for the whole world? Then yeah, you should already be isolating separating compartmentalizing...
- myself248 5y ago
  > photos in iCloud? I mean, the last fappening was done by phishing, as I recall. Are you saying another one, done by rowhammer, wouldn't be a problem? I suspect most folks have stuff they'd rather not make public. Credit card numbers, at the very least. This affects us all.
  - pas 5y ago
    While there are clearly bad (and some interesting) ethical aspects of the Fappening, it was not a big problem for society. Everyday many people experience the same violation of their privacy (revenge porn sites, accidentally sending nudes to the wrong address, etc), and life goes on. (And as far as I know nobody of the affected celebs have taken drastic measures, while unfortunately this cannot be said for non-celebs, as cyberbullying regularly gets people to attempt suicide with "success".) Similarly the day-to-day ransomwares probably cost more than securing browsers will.
- javajosh 5y ago
  You don't have to be in charge of launch codes to worry about this one. I mean, if anyone can 'npm install rowhammer' and reliably attack anyone that visits their site, even in a modern browser, then it's time to turn js off. I'm okay if there are some minor or even moderate XSS exploits out there; but a hardware vuln accessible to javascript means javascript goes bye bye for now, at least from my local machine's browser.
  - pas 5y ago
    If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. If it comes you'll hear about "apps" that freeze every other browser process while you do online banking. That said, proactively blocking JS is great for many reasons, and you can whitelist sites you sort of trust.
    - ziddoap 5y ago
      >If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. This is a pretty laissez-faire attitude with regards to security-critical exploits. You might be the one of the first ones affected. After all, someone has to be first one before they can post it on HN. In a more general sense, it's a bad idea to rely on someone else as your primary alert. Whether it is a HN post, news article, whatever. (I know that you aren't quite saying to use it as a primary alert, but a cursory read of your comment implies it, so it's worth discussing.)
      - scandinavian 5y ago
        > You might be the one of the first ones affected If you are regularly the fist target of zero-days your threat model should be stricter yes. The other 7.9 billion people in the world can afford to be a little less strict.
        ziddoap 5y ago
        I didn't consider "don't wait for someone else to get hacked and tell you about it" to be a particularly strict method of security, but sure, I guess so.
notyourday 5y ago
> Um, how concerned should I be about this? Not at all. It is another one of the Chicken Little's security theater that sound sexy and sophisticated but in practice mean nothing. If you are concerned about this issue you should first ensure that you never type "npm install" or copy something off Stack Overflow into your code.
- acuozzo 5y ago
  > Not at all. https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs This has existed for years and its use has been observed in the wild. RowHammer isn't new.
  - notyourday 5y ago
    Does. Not. Work. Against. A. Random. Machine. That. Fetches. It. You pulling 15Gb of Nodejs modules in your app that you have no idea about because you think someone, somewhere ensured that they are "correct" importing a supply chain attacks works every single time.

Terr_ 5y ago

> Is it time to turn off javascript in the browser? I've been browsing with Javascript off-by-default for years and recommend it regardless. Sure, perhaps a site I trusted and whitelisted will try to hack me, but I feel it's far less likely than some random typo-squatting site or advertising-broker logic.

egberts1 5y ago

JavaScript, despite compiler hardening, is still subjectable to SPECTRE-like actions. It’s in the compilers’ mitigation effort and CPU memory controllers both. Something about CPU firmware and its inability to fix some aspect of memory bank controllers.

pas 5y ago

It depends on how concerned are you about the regular security issues. Which ideally depends on the things you are responsible for. If it's your family photos in iCloud? Nah. If it's the nuclear launch codes for the whole world? Then yeah, you should already be isolating separating compartmentalizing...

myself248 5y ago
> photos in iCloud? I mean, the last fappening was done by phishing, as I recall. Are you saying another one, done by rowhammer, wouldn't be a problem? I suspect most folks have stuff they'd rather not make public. Credit card numbers, at the very least. This affects us all.
- pas 5y ago
  While there are clearly bad (and some interesting) ethical aspects of the Fappening, it was not a big problem for society. Everyday many people experience the same violation of their privacy (revenge porn sites, accidentally sending nudes to the wrong address, etc), and life goes on. (And as far as I know nobody of the affected celebs have taken drastic measures, while unfortunately this cannot be said for non-celebs, as cyberbullying regularly gets people to attempt suicide with "success".) Similarly the day-to-day ransomwares probably cost more than securing browsers will.
javajosh 5y ago
You don't have to be in charge of launch codes to worry about this one. I mean, if anyone can 'npm install rowhammer' and reliably attack anyone that visits their site, even in a modern browser, then it's time to turn js off. I'm okay if there are some minor or even moderate XSS exploits out there; but a hardware vuln accessible to javascript means javascript goes bye bye for now, at least from my local machine's browser.
- pas 5y ago
  If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. If it comes you'll hear about "apps" that freeze every other browser process while you do online banking. That said, proactively blocking JS is great for many reasons, and you can whitelist sites you sort of trust.
  - ziddoap 5y ago
    >If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. This is a pretty laissez-faire attitude with regards to security-critical exploits. You might be the one of the first ones affected. After all, someone has to be first one before they can post it on HN. In a more general sense, it's a bad idea to rely on someone else as your primary alert. Whether it is a HN post, news article, whatever. (I know that you aren't quite saying to use it as a primary alert, but a cursory read of your comment implies it, so it's worth discussing.)
    - scandinavian 5y ago
      > You might be the one of the first ones affected If you are regularly the fist target of zero-days your threat model should be stricter yes. The other 7.9 billion people in the world can afford to be a little less strict.
      - ziddoap 5y ago
        I didn't consider "don't wait for someone else to get hacked and tell you about it" to be a particularly strict method of security, but sure, I guess so.

notyourday 5y ago

> Um, how concerned should I be about this? Not at all. It is another one of the Chicken Little's security theater that sound sexy and sophisticated but in practice mean nothing. If you are concerned about this issue you should first ensure that you never type "npm install" or copy something off Stack Overflow into your code.

acuozzo 5y ago
> Not at all. https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs This has existed for years and its use has been observed in the wild. RowHammer isn't new.
- notyourday 5y ago
  Does. Not. Work. Against. A. Random. Machine. That. Fetches. It. You pulling 15Gb of Nodejs modules in your app that you have no idea about because you think someone, somewhere ensured that they are "correct" importing a supply chain attacks works every single time.