4 ms·
> websites can avoid by setting the appropriate HTTP headers/HTML attributes. Individual sites plugging browser + CPU security holes seems like a violation of
by danans 2y ago
> websites can avoid by setting the appropriate HTTP headers/HTML attributes.
Individual sites plugging browser + CPU security holes seems like a violation of separation of concerns. Yes, I hope every bank out there puts this workaround into their site ASAP, but that's hardly a solution for the flaw itself.
- lxgr 2y agoThe permanent solution to the flaw is either a hardware/OS-side fix (i.e. disabling this particular kind of speculation via a chicken bit, if there is one), or Safari implementing site isolation in the same way Chrome and Firefox are already doing. But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while, websites should still take the precautions they can. It's a good idea for other reasons anyway: Why keep around an inter-context messaging mechanism you possibly don't even need?
- danans 2y ago> But as the former might well be impossible (at least without ruining performance or requiring a hardware swap), and the latter might take a while, According to the site they informed Apple in May 2024. Should that not have been enough time?
- lxgr 2y agoIt took Chrome and Firefox years to achieve complete tab separation, so yes, it does seem too close, unfortunately.
- KingOfCoders 2y agoNo. For fanboys, everything Apple does is the best thing anyone could ever do. So if Apple needs more time, then it is impossible to be faster. And last line of defense "Whataboutism". I wish people would not be so predictable and boring.