om2

24 ms·

241.
by om2 8y ago
I'm the person who posted the tweet. Since then, some of my colleagues from the WebKit team have given more specific security feedback. Some of it has been addressed. And the Security Considerations section is less scary. But even so,
242.
by om2 8y ago
It is not in fact exposed to the web, you weren't wrong about that.
243.
by om2 8y ago
I don't see it when I inspect Google Search results. Instead I see a mouse down handler that rewrites the link's href to go through a google.com redirector. How did you spot the use of `ping`? Maybe they are running an A/B te
244.
by om2 8y ago
Arewefastyet has Mac results, but it only includes Firefox on Mac, not Safari or Chrome.
245.
by om2 8y ago
arewefastyet.com still exists but it only includes Chrome and Firefox, not Safari.
246.
by om2 8y ago
A lot of this article is about benchmark construction methodology and performance optimizations. If you just want to see a cross-browser JavaScript performance comparison, scroll to the bottom.
247.
by om2 8y ago
Some services use WebRTC in a "hub and spoke" model rather than true peer-to-peer, and they often require VP8 due to a desire to support low-end Android devices that don't have hardware H.264 decoding.
248.
by om2 8y ago
In Safari, we have UI that always allows you to see which tabs are using a connection and stop them.
249.
by om2 8y ago
Fortunately, Safari's WebRTC won't silently leak your private IP address or other network info. We've also proposed a new protocol extension that enables peer-to-peer pure data connections in a privacy-aware way. https:&#x2F
250.
by om2 8y ago
v8 was initially 32-bit x86 only. And it wasn’t coded in a CPU independent way or word size independent way at all. Adding a new CPU amounted to basically rewriting the whole JIT. Chrome took a long time to go 64-bit for this reason.
251.
by om2 8y ago
I wish they had at east posted a browser-runnable version of their test so we could see for ourselves which browser is which, or compare JS vs WASM on our own systems. (On this type of code, I'd expect Safari to be the fastest, not Chr
252.
by om2 8y ago
The pyramids were not made of concrete. They were built from sandstone blocks and clad in limestone. and the stones were cut using stone tools, not copper. Copper is too soft for stone working but quite a few rocks are harder than sandstone
253.
by om2 8y ago
That’s not how I’ve heard the term used. The meaning I’m familiar with is “person closely known to the card holder incurs a charge that isn’t really authorized”, for example you might have access to their computer but aren’t supposed to use
254.
by om2 8y ago
In this case the humility is unnecessary, as the linked bug report includes Apple WebKit folks acknowledging that it's a bug and pointing to our internal bug tracking it (turns out it has to be fixed below the WebKit level).
255.
by om2 8y ago
In theory maybe, but in practice we rarely do. Sometimes even when the idea is pretty clear, like WebKit's CSS JIT, it's not that easy to copy because of underlying assumptions.
256.
by om2 8y ago
It’s on in Safari Technology Preview: https://webkit.org/status/#specification-webgl-2 We have no particular stance against it, though I agree with the other poster that WebGL is more the future.
257.
by om2 8y ago
And on the topic of this thread, Safari also has the best privacy protections: < https://webkit.org/blog/8311/intelligent-tracking-prevention... .
258.
by om2 8y ago
https://bugs.webkit.org Doesn’t requir an Apple ID and also has public visibility (except security bugs). Update: the bug has already been filed in both the WebKit bug tracker and Radar, so no need for further reports. https:&#
259.
by om2 9y ago
On some CPUs, cmov is known not to speculate, but in those cases it is apparently super slow.
260.
by om2 9y ago
> > web pages can load cross origin resources > I know nothing about web technologies, but maybe this is something we should stop doing, at least for any executable resource? This would prevent JS ads I guess, so win/win? It&#
261.
by om2 9y ago
Interpreters generally do a lot of branches, so they are also vulnerable to Spectre.
262.
by om2 9y ago
Chrome is working towards something like this with Site Isolation, and it’s a good idea. Unfortunately it’s not a complete defense. First, web pages can load cross origin resources, and that may be enough to get data or a cookie into the at
263.
by om2 9y ago
We are looking at ways to make it more precise but with random jitter. 1ms is a stopgap.
264.
by om2 9y ago
We assume no if statements that implement a security check are safe without something. It’s not just bounds checks and type checks. Origin checks are a special case worth considering. I am not sure what you describe would be exploitable in
265.
by om2 9y ago
The scary thing is that without mitigations, it is shockingly easy to pull off. WebKit engineers made multiple fully working exploits internally and we would be hard pressed to do that for other kinds of vulnerabilities. Building full explo
266.
by om2 9y ago
Built-in JavaScript has a better security track record than Flash and it’s ActionScript engine.
267.
by om2 9y ago
The mitigations are largely in code produced by the JIT. It's not hard to patch the JIT's codgen to back this out (perhaps even based on current CPU) if it becomes unnecessary. It would be nice if CPU architectures never had this
268.
by om2 9y ago
The fence instruction that Intel recommends (lfence) is way slower than the techniques described here. We measured a 5x slowdown on Web Assembly trying to use it. Also we have been working on these mitigations since well before Intel made t
269.
by om2 9y ago
I might be super confused about versions, but security update 2017-002 Sierra claims to include the patch according to this page: https://support.apple.com/en-us/HT208331
270.
by om2 9y ago
This statement doesn’t make it clear, but they have been patched (same fixes as High Sierra)

More ›