6 ms·
CheerpX looks amazing. Not blaming that project it in any way. But rowhammer is still a thing. There's a whole stack of abstractions, that all _may be_ vulner
by jfoutz 5y ago
CheerpX looks amazing. Not blaming that project it in any way.
But rowhammer is still a thing.
There's a whole stack of abstractions, that all _may be_ vulnerable. I'm sure CheerpX is very good, but there's no way to _know_ that all the dependencies from the toolchain used to build all the way down to the running environment is actually bug free.
As a first line of investigation, I'd suspect cheerpX, just because so many eyes look at browser sandboxes. _shrug_ your milage may vary.
- saagarjha 5y agoYou can Rowhammer from JavaScript already, so this really has nothing to do with CheerpX.
- jfoutz 5y agoVery true. Let me try to restate. I don't know how to prove the absence of a thing. I can only prove existence. I was trying to highlight that every layer of abstraction has vulnerabilities all the way down to the hardware level. I'm perfectly willing to accept that CheerpX has no known vulnerabilities.
- jerry1979 5y agoIt may have more to do with the idea that since CheerpX runs in the browser, the threat model of CheerpX is the same as the thread model of using your web browser to browse any other site.