3 ms·

I'd be curious about the overhead if the browser was running in kernel space. This would be surprisingly secure since browsers provide some of the most hardened

by klabb3 5y ago

I'd be curious about the overhead if the browser was running in kernel space. This would be surprisingly secure since browsers provide some of the most hardened sandboxing out there. Obligatory: https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...

10000truths 5y ago
You've got it the wrong way around - the browsers' sandboxing is good because they make use of resource isolation features provided by your kernel.
- klabb3 5y ago
  Is that so? I thought even different contexts within the same browser context were well isolated. For instance, isn't the reason arbitrary web pages can't access my Lastpass credentials is due to this sandboxing?
  - ale42 5y ago
    You can't enforce real isolation in user mode, you need the kernel to do it.
  - kevingadd 5y ago
    The browser security model relies heavily on protection from things like process isolation, ASLR, etc though at this point browsers also implement their own defense in depth mechanisms on top. for example, jsc maintains separate heaps for each data type - referred to as cages, i think - so that it's hard to perform type confusion attacks. but there are entire classes of attacks that would be viable against browsers if not for the tools they get from the kernel like ACLs, page protections, ASLR, control flow guard, etc. When one part of the stack of protections fails, you can see things like persistent root on chromebooks where that one hole is used as a springboard to attack other vulnerabilities: https://news.ycombinator.com/item?id=15713103 https://news.ycombinator.com/item?id=15713103
loa_in_ 5y ago
It would be much slower because of so many context switches
- ygra 5y ago
  (In)famously, Windows NT put GDI into the kernel for performance reasons. Any application wanting to draw something would also have to pay for that context switch, which apparently was deemed not a problem back then. Have context switches become that much more expensive since then?
valgaze 5y ago
See @ 13min12s on klabb3's link Note that presentation was from 2014, I wonder what that'd look like in 2022

by klabb3 5y ago

10000truths 5y ago

You've got it the wrong way around - the browsers' sandboxing is good because they make use of resource isolation features provided by your kernel.

klabb3 5y ago
Is that so? I thought even different contexts within the same browser context were well isolated. For instance, isn't the reason arbitrary web pages can't access my Lastpass credentials is due to this sandboxing?
- ale42 5y ago
  You can't enforce real isolation in user mode, you need the kernel to do it.
- kevingadd 5y ago
  The browser security model relies heavily on protection from things like process isolation, ASLR, etc though at this point browsers also implement their own defense in depth mechanisms on top. for example, jsc maintains separate heaps for each data type - referred to as cages, i think - so that it's hard to perform type confusion attacks. but there are entire classes of attacks that would be viable against browsers if not for the tools they get from the kernel like ACLs, page protections, ASLR, control flow guard, etc. When one part of the stack of protections fails, you can see things like persistent root on chromebooks where that one hole is used as a springboard to attack other vulnerabilities: https://news.ycombinator.com/item?id=15713103 https://news.ycombinator.com/item?id=15713103

loa_in_ 5y ago

It would be much slower because of so many context switches

ygra 5y ago
(In)famously, Windows NT put GDI into the kernel for performance reasons. Any application wanting to draw something would also have to pay for that context switch, which apparently was deemed not a problem back then. Have context switches become that much more expensive since then?

valgaze 5y ago

See @ 13min12s on klabb3's link Note that presentation was from 2014, I wonder what that'd look like in 2022