4 ms·

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-D

Memory issues and JIT bugs mostly :) https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine. Moreover, we know that attackers weaponize and abuse these bugs as well; an analysis from Mozilla shows that over half of the “in the wild” Chrome exploits abused a JIT bug, as illustrated in the charts below. Note “Edge” below refers to the legacy version of Edge. https://msrc-blog.microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/ https://msrc-blog.microsoft.com/2019/07/16/a-proactive-appro... >Figure 1: ~70% of the vulnerabilities Microsoft assigns a CVE each year continue to be memory safety issues >C++ does have its virtues that make it attractive and in some cases essential: it is blisteringly fast, it has a small memory and disk footprint, it’s mature, it’s execution predictable, its platform applicably is almost unparalleled and you can use it without having to install additional components. If only the developers could have all the memory security guarantees of languages like .NET C# combined with all the efficiencies of C++. Maybe we can: One of the most promising newer systems programming languages that satisfy those requirements is the Rust programming language originally invented by Mozilla. https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... >The Chromium project finds that around 70% of our serious security bugs are memory safety problems. Our next major project is to prevent such bugs at source. >Using safer languages anywhere applicable >>Rust ______________ As you see you can literally turn off JIT with a few clicks and make your browser way safer. Unfortunely you cannot force people to use Rust or other safe environments like .NET or Javas

shp0ngle 4y ago
Chrome code size is giant, it's hard to "just" rewrite it to Rust. There seem to be some experiments with adding Rust code slowly, but there seem to be some interop issues.
- winrid 4y ago
  There's also plenty of hand rolled assembly in there...
gus_massa 4y ago
> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?
- greenthrow 4y ago
  No. Gmail is likely slow to load because it's loading, not because of code execution time. Disabling JIT doesn't make much difference for most users most od the time. Protip: archive your inbox regulaely to improve gmail load time.
- RadiozRadioz 4y ago
  I recommend switching Gmail to HTML mode[1]. I switched a few months ago, so much faster, never looked back. [1]: https://support.google.com/mail/answer/15049?hl=en https://support.google.com/mail/answer/15049?hl=en
  - dopa42365 4y ago
    Or an email client of your choice? I don't even remember when I last checked my emails on a website.
  - deleted 4y ago
    [deleted]
  - svnpenn 4y ago
    only works until you log out, then once you log in again, its back to shit mode
edwnj 4y ago
A lot of criticisms on the way Mozilla was managed over the past few years, especially in terms of investments.. I think what they've done with rust hands down makes up for all it and more. That language has the potential to really change the entire landscape.
fancl20 4y ago
How Rust's memory safety can help to solve JIT generating bug code? BTW Chromium is testing rewriting critical parts in Rust (https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/rust-toolchain.md https://chromium.googlesource.com/chromium/src/+/refs/heads/...)
- saagarjha 4y ago
  It can’t, at least not directly. However, it can prevent bugs in the JIT runtime itself from being exploited.
- tester756 4y ago
  I said that turning off JIT with two a few clicks makes your browser significantly more secure Rust is an improvement to memory related issues
  - anuraaga 4y ago
    Rust seems to provide memory safety built-in that is still possible in C++ with appropriate linters / static analysis (e.g., don't ever assign a `new` pointer to anything other than a unique one). I remember Google's codebase generally being good on this, but does Chromium not follow that? My guess is yes and these are issues that would affect both languages equally, with Rust it just happens to be in an `unsafe` block.
beanjuiceII 4y ago
i'd say that most of this code would have to live in unsafe rust
- marcosdumay 4y ago
  Probably not. Code analysis and rewriting can all be done on safe rust. It's only data gathering and execution that needs unsafe, and those are the small and easy parts.
Grimburger 4y ago
> you can literally turn off JIT with a few clicks Am I the only one not able to see this for browsers other than Microsoft Edge? Disabling JIT looks like cli flags only for Chrome/Brave/etc, which isn't activated when you've clicked on a link outside the browser or other methods for launching the default browser application, probably the most important times for security as it's often initiating login flows for apps or password resets. Additionally it disables WASM, whereas Edge has alternate means to run WASM with JIT disabled. Pretty disappointing to see from Google given the sheer extent of other in-browser settings flags.
- l2022 4y ago
  Another approach, if on Windows, is to use the powerful HitmanPro Alert, which includes "Jit Guard", which will work across the board.
Waterluvian 4y ago
What percentage of the total code in Chromium is the JIT? (acknowledging that this is a very fuzzy question)

shp0ngle 4y ago

Chrome code size is giant, it's hard to "just" rewrite it to Rust. There seem to be some experiments with adding Rust code slowly, but there seem to be some interop issues.

winrid 4y ago
There's also plenty of hand rolled assembly in there...

gus_massa 4y ago

> As you see you can literally turn off JIT with a few clicks and make your browser way safer. Gmail takes forever to load in my machine. How much worse is the performance if I disable the JIT? x5?

greenthrow 4y ago
No. Gmail is likely slow to load because it's loading, not because of code execution time. Disabling JIT doesn't make much difference for most users most od the time. Protip: archive your inbox regulaely to improve gmail load time.
RadiozRadioz 4y ago
I recommend switching Gmail to HTML mode[1]. I switched a few months ago, so much faster, never looked back. [1]: https://support.google.com/mail/answer/15049?hl=en https://support.google.com/mail/answer/15049?hl=en
- dopa42365 4y ago
  Or an email client of your choice? I don't even remember when I last checked my emails on a website.
- deleted 4y ago
  [deleted]
- svnpenn 4y ago
  only works until you log out, then once you log in again, its back to shit mode

edwnj 4y ago

A lot of criticisms on the way Mozilla was managed over the past few years, especially in terms of investments.. I think what they've done with rust hands down makes up for all it and more. That language has the potential to really change the entire landscape.

fancl20 4y ago

How Rust's memory safety can help to solve JIT generating bug code? BTW Chromium is testing rewriting critical parts in Rust (https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/rust-toolchain.md https://chromium.googlesource.com/chromium/src/+/refs/heads/...)

saagarjha 4y ago
It can’t, at least not directly. However, it can prevent bugs in the JIT runtime itself from being exploited.
tester756 4y ago
I said that turning off JIT with two a few clicks makes your browser significantly more secure Rust is an improvement to memory related issues
- anuraaga 4y ago
  Rust seems to provide memory safety built-in that is still possible in C++ with appropriate linters / static analysis (e.g., don't ever assign a `new` pointer to anything other than a unique one). I remember Google's codebase generally being good on this, but does Chromium not follow that? My guess is yes and these are issues that would affect both languages equally, with Rust it just happens to be in an `unsafe` block.

beanjuiceII 4y ago

i'd say that most of this code would have to live in unsafe rust

marcosdumay 4y ago
Probably not. Code analysis and rewriting can all be done on safe rust. It's only data gathering and execution that needs unsafe, and those are the small and easy parts.

Grimburger 4y ago

> you can literally turn off JIT with a few clicks Am I the only one not able to see this for browsers other than Microsoft Edge? Disabling JIT looks like cli flags only for Chrome/Brave/etc, which isn't activated when you've clicked on a link outside the browser or other methods for launching the default browser application, probably the most important times for security as it's often initiating login flows for apps or password resets. Additionally it disables WASM, whereas Edge has alternate means to run WASM with JIT disabled. Pretty disappointing to see from Google given the sheer extent of other in-browser settings flags.

l2022 4y ago
Another approach, if on Windows, is to use the powerful HitmanPro Alert, which includes "Jit Guard", which will work across the board.

Waterluvian 4y ago

What percentage of the total code in Chromium is the JIT? (acknowledging that this is a very fuzzy question)