2 ms·
Chrome runs each origin in a different process. Chrome also runs all the privileged code in separate processes, so like file, network, GPU, and many OS calls ar
by esprehn 4y ago
Chrome runs each origin in a different process. Chrome also runs all the privileged code in separate processes, so like file, network, GPU, and many OS calls are not actually happening from within the same process as v8 executing web JS code. Process isolation is also necessary to mitigate CPU and OS level timing attacks between origins (and the privileged process).
v8 is a pretty good security boundary, but to be as secure as Chrome you need the other layers too.
- aboodman 4y agoHi Elliot! I think it's more complex than that. Chrome (all web browsers) have a massive and ancient attack surface -- all of HTML, JS, CSS, every DOM and web platform API, every image codec, video, and on and on and on. CF workers have a comparatively minuscule attack surface that takes into account all the most recent lessons (high-res timers, for example). So yeah, if we call Chrome of 2008 a baseline, then Chrome's more recent process isolation increases security. But so to does CF's much reduced attack surface.
- esprehn 4y agoI wouldn't say those are equivalent. Any exploit in v8 gets full access to the process, which in a multi tenant situation means access to other tenants. And v8 itself is hardly bug free. Reducing the JS API surface might reduce the probability of finding a way out, but it doesn't reduce the blast radius. 2008 was also 14 years ago, I'm not sure that's the right bar for security! The OP was also speaking to using v8 getting you the same level of security as Chrome, not to architectural decisions in CF beyond that.
- deleted 4y ago[deleted]