3 ms·

I didn't know about Super Duper Secure Mode. That's pretty interesting. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoft

I didn't know about Super Duper Secure Mode. That's pretty interesting. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...

alexb_ 4y ago
Would this prevent me from looking at or modifying the Javascript code that is running, since it's already compiled?
- fluidcruft 4y ago
  Hmmm. Maybe I misunderstood the link or missed something. I thought all they did is disable JIT and leave the JS as interpreted.
  - alexb_ 4y ago
    I'm not knowledgable with JS at all, so you're probably right. I do wonder what the "Code Integrity Guard" is going to mean - who has to sign the JS? Does this mean tampermonkey/adblock scripts would stop working? Genuinely asking as like I said I don't really know too much about javascript
    - wzdd 4y ago
      This seems to be referring to https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard https://docs.microsoft.com/en-us/microsoft-365/security/defe... which would mean that they require the browser itself to be digitally signed, not the JS.
- genezeta 4y ago
  This is a completely different thing. The "super duper secure mode" is not at all about you accessing or modifying the JS code from a website you are visiting. What it is about is trying to protect against some piece of JS code bypassing the security of the browser sandbox and accessing stuff it shouldn't ever have access to. :) Edit: Also, in general, no, disabling JIT would not prevent any particular JS code or extension from running. At most, it might mean some code would run slower. But that's what they claim, that it isn't noticeable.
  - alexb_ 4y ago
    Thanks for the clarification.
creamedcabbage 4y ago
GrapheneOS adds a permission to chromium on android so you can manually allow websites to have their javascript JIT'd. Most websites are plenty quick without the JIT although SPAs like Tinder and Google Maps did struggle without it.
- easrng 4y ago
  I use Bromite which does the same and the only issue I run into is when sites need WASM. (Chromium doesn't have a non-JIT WASM interpreter, though IIRC Edge does.)

alexb_ 4y ago

Would this prevent me from looking at or modifying the Javascript code that is running, since it's already compiled?

fluidcruft 4y ago
Hmmm. Maybe I misunderstood the link or missed something. I thought all they did is disable JIT and leave the JS as interpreted.
- alexb_ 4y ago
  I'm not knowledgable with JS at all, so you're probably right. I do wonder what the "Code Integrity Guard" is going to mean - who has to sign the JS? Does this mean tampermonkey/adblock scripts would stop working? Genuinely asking as like I said I don't really know too much about javascript
  - wzdd 4y ago
    This seems to be referring to https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard https://docs.microsoft.com/en-us/microsoft-365/security/defe... which would mean that they require the browser itself to be digitally signed, not the JS.
genezeta 4y ago
This is a completely different thing. The "super duper secure mode" is not at all about you accessing or modifying the JS code from a website you are visiting. What it is about is trying to protect against some piece of JS code bypassing the security of the browser sandbox and accessing stuff it shouldn't ever have access to. :) Edit: Also, in general, no, disabling JIT would not prevent any particular JS code or extension from running. At most, it might mean some code would run slower. But that's what they claim, that it isn't noticeable.
- alexb_ 4y ago
  Thanks for the clarification.

creamedcabbage 4y ago

GrapheneOS adds a permission to chromium on android so you can manually allow websites to have their javascript JIT'd. Most websites are plenty quick without the JIT although SPAs like Tinder and Google Maps did struggle without it.

easrng 4y ago
I use Bromite which does the same and the only issue I run into is when sites need WASM. (Chromium doesn't have a non-JIT WASM interpreter, though IIRC Edge does.)