6 ms·

Apple Disables WebKit's JIT in Lockdown Mode, & BrowserEngineKit Is Restricted

• ec109685 2y ago
  Why doesn’t Apple just insist that JIT work happen within a firecracker like VM? That seems like the safest place to run untrusted code versus hoping every developer treat external code extremely carefully.
• altairprime 2y ago
  I bet they eventually run JITs using the exclave system, so that they can have full JIT performance in a hardware-isolated space. Lockdown mode is a good mitigation but a two-thirds performance loss is unacceptable, and once they get it working for lockdown mode they can drop all the hoopla. (Though it’ll still be complicated for multitasked apps on iPad.)
  • ectospheno 2y ago
    Running lockdown mode since it released. Seems fine to me.