5 ms·

V8 is still very hard to escape -- an escape is a remote hole in Chrome isn't it? To be honest, I'm happy to base my security on "as safe as Chrome".

zsims 4y ago
If the patch gap is small, yes. But are you patching V8? Node generally isn't.
- aboodman 4y ago
  As a user of CF workers, the API is clearly designed to allow the runtime to redeploy e.g., for patches. Example: there is no notification when your worker is unloading. It just dies. This is sometimes annoying as a developer, but it's the kind of decision a platform makes when it wants (needs) to be able to shut down code arbitrarily and restart it later on a different version of the platform.
esprehn 4y ago
Chrome runs each origin in a different process. Chrome also runs all the privileged code in separate processes, so like file, network, GPU, and many OS calls are not actually happening from within the same process as v8 executing web JS code. Process isolation is also necessary to mitigate CPU and OS level timing attacks between origins (and the privileged process). v8 is a pretty good security boundary, but to be as secure as Chrome you need the other layers too.
- aboodman 4y ago
  Hi Elliot! I think it's more complex than that. Chrome (all web browsers) have a massive and ancient attack surface -- all of HTML, JS, CSS, every DOM and web platform API, every image codec, video, and on and on and on. CF workers have a comparatively minuscule attack surface that takes into account all the most recent lessons (high-res timers, for example). So yeah, if we call Chrome of 2008 a baseline, then Chrome's more recent process isolation increases security. But so to does CF's much reduced attack surface.
  - esprehn 4y ago
    I wouldn't say those are equivalent. Any exploit in v8 gets full access to the process, which in a multi tenant situation means access to other tenants. And v8 itself is hardly bug free. Reducing the JS API surface might reduce the probability of finding a way out, but it doesn't reduce the blast radius. 2008 was also 14 years ago, I'm not sure that's the right bar for security! The OP was also speaking to using v8 getting you the same level of security as Chrome, not to architectural decisions in CF beyond that.
    - deleted 4y ago
      [deleted]
mike_d 4y ago
> an escape is a remote hole in Chrome isn't it Maybe. Chrome has a lot of extra security hardening you don't get if you are just running the V8 engine alone. The going rate for a V8 escape is probably around $100k at the moment. Totally worth it financially to snarf credit cards from all the sites on Cloudflare.

zsims 4y ago

If the patch gap is small, yes. But are you patching V8? Node generally isn't.

aboodman 4y ago
As a user of CF workers, the API is clearly designed to allow the runtime to redeploy e.g., for patches. Example: there is no notification when your worker is unloading. It just dies. This is sometimes annoying as a developer, but it's the kind of decision a platform makes when it wants (needs) to be able to shut down code arbitrarily and restart it later on a different version of the platform.

esprehn 4y ago

Chrome runs each origin in a different process. Chrome also runs all the privileged code in separate processes, so like file, network, GPU, and many OS calls are not actually happening from within the same process as v8 executing web JS code. Process isolation is also necessary to mitigate CPU and OS level timing attacks between origins (and the privileged process). v8 is a pretty good security boundary, but to be as secure as Chrome you need the other layers too.

aboodman 4y ago
Hi Elliot! I think it's more complex than that. Chrome (all web browsers) have a massive and ancient attack surface -- all of HTML, JS, CSS, every DOM and web platform API, every image codec, video, and on and on and on. CF workers have a comparatively minuscule attack surface that takes into account all the most recent lessons (high-res timers, for example). So yeah, if we call Chrome of 2008 a baseline, then Chrome's more recent process isolation increases security. But so to does CF's much reduced attack surface.
- esprehn 4y ago
  I wouldn't say those are equivalent. Any exploit in v8 gets full access to the process, which in a multi tenant situation means access to other tenants. And v8 itself is hardly bug free. Reducing the JS API surface might reduce the probability of finding a way out, but it doesn't reduce the blast radius. 2008 was also 14 years ago, I'm not sure that's the right bar for security! The OP was also speaking to using v8 getting you the same level of security as Chrome, not to architectural decisions in CF beyond that.
  - deleted 4y ago
    [deleted]

mike_d 4y ago

> an escape is a remote hole in Chrome isn't it Maybe. Chrome has a lot of extra security hardening you don't get if you are just running the V8 engine alone. The going rate for a V8 escape is probably around $100k at the moment. Totally worth it financially to snarf credit cards from all the sites on Cloudflare.