4 ms·
You do you but I hope you've also turned off JavaScript in your web browser.
by Veliladon 4y ago
You do you but I hope you've also turned off JavaScript in your web browser.
- netr0ute 4y agoI keep my important info on paper.
- coldpie 4y agoIs there any evidence of anyone actually attempting such an attack outside a carefully controlled research scenario? The number of stars that have to align for this theoretical attack to work in practice is so high that I don't think any normal desktop end-user has reason to worry about it. (Shared servers, co-hosted VMs, etc are a different story.)
- garaetjjte 4y agoI think there might be herd immunity effect to that: because mitigations are enabled by default, there isn't much focus for developing attacks for it.
- totony 4y agoBrowser lowered timer resolution to mitigate most speculative execution attacks. Probably why there aren't useful exploits. I remember a js payload when the first spectre appeared.
- Veliladon 4y agoTrue there isn't at the moment but do you really want to be the first to find out because you left the back door open?
- renewiltord 4y agoI am going to tell you guys something magical. There are multiple hundreds of millions of cryptocurrency running on hardware with spectre/meltdown mitigations off. Go get them.
- coldpie 4y agoI'd liken it to refusing to leave your house because you're worried a meteor may strike you down. You're giving up a lot for not much reason.
- staticassertion 4y agoNot quite. A meteor is an object with no drive or desire. Attackers are adversarial and thoughtful. You can't liken a random event to a purposeful act like this. It's more like saying "refusing to leave your house because you're worried you might get mugged", which might actually be very reasonable if you live in a bad neighborhood, you're a common target of crime, etc. It may not be reasonable for many others. But analogies are pretty rough in general.
- coldpie 4y agoNo, I think meteor is closer. Mugging is in the realm of possibility, this javascript driveby theoretical attack is wildly implausible. Like, take the time to spell it out: what sequence of events has to occur for this attack to be successfully pulled off?
- staticassertion 4y agoWhich attack are you referring to? There have already been POCs for many speculative execution attacks.