5 ms·

You don't have to be in charge of launch codes to worry about this one. I mean, if anyone can 'npm install rowhammer' and reliably attack anyone that visits the

You don't have to be in charge of launch codes to worry about this one. I mean, if anyone can 'npm install rowhammer' and reliably attack anyone that visits their site, even in a modern browser, then it's time to turn js off. I'm okay if there are some minor or even moderate XSS exploits out there; but a hardware vuln accessible to javascript means javascript goes bye bye for now, at least from my local machine's browser.

pas 5y ago
If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. If it comes you'll hear about "apps" that freeze every other browser process while you do online banking. That said, proactively blocking JS is great for many reasons, and you can whitelist sites you sort of trust.
- ziddoap 5y ago
  >If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. This is a pretty laissez-faire attitude with regards to security-critical exploits. You might be the one of the first ones affected. After all, someone has to be first one before they can post it on HN. In a more general sense, it's a bad idea to rely on someone else as your primary alert. Whether it is a HN post, news article, whatever. (I know that you aren't quite saying to use it as a primary alert, but a cursory read of your comment implies it, so it's worth discussing.)
  - scandinavian 5y ago
    > You might be the one of the first ones affected If you are regularly the fist target of zero-days your threat model should be stricter yes. The other 7.9 billion people in the world can afford to be a little less strict.
    - ziddoap 5y ago
      I didn't consider "don't wait for someone else to get hacked and tell you about it" to be a particularly strict method of security, but sure, I guess so.
- acuozzo 5y ago
  > If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. It did come to that, years ago: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs

pas 5y ago

If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. If it comes you'll hear about "apps" that freeze every other browser process while you do online banking. That said, proactively blocking JS is great for many reasons, and you can whitelist sites you sort of trust.

ziddoap 5y ago
>If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. This is a pretty laissez-faire attitude with regards to security-critical exploits. You might be the one of the first ones affected. After all, someone has to be first one before they can post it on HN. In a more general sense, it's a bad idea to rely on someone else as your primary alert. Whether it is a HN post, news article, whatever. (I know that you aren't quite saying to use it as a primary alert, but a cursory read of your comment implies it, so it's worth discussing.)
- scandinavian 5y ago
  > You might be the one of the first ones affected If you are regularly the fist target of zero-days your threat model should be stricter yes. The other 7.9 billion people in the world can afford to be a little less strict.
  - ziddoap 5y ago
    I didn't consider "don't wait for someone else to get hacked and tell you about it" to be a particularly strict method of security, but sure, I guess so.
acuozzo 5y ago
> If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it. It did come to that, years ago: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs