Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Spectre and Meltdown Mean for WebKit

webkit.org

Post reply on HN
Print view View original

31–40 of 294 posts

Re: What Spectre and Meltdown Mean for WebKit

#31

Post by pizlonator »

username223 wrote: post #5

> WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user’s processor... WebKit is affected by both issues because WebKit allows untrusted code to run on users’ processors. There's the elephant in the room, though this article doesn't go far enough. Trust isn't binary. It's not that the code isn't formally verified, or doesn't t…

And yet presumably you didn't get pwned in the process of writing that comment. It's true that securing the execution of untrusted code is hard. But it's not impossible.

Re: What Spectre and Meltdown Mean for WebKit

#32

Post by madez »

pizlonator wrote: post #31
username223 wrote: post #5

> WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user’s processor... WebKit is affected by both issues because WebKit allows untrusted code to run on users’ processors. There's the elephant in the room, though this article doesn't go far enough. Trust isn't binary. It's not that the code isn't formally verified, or doesn't t…

And yet presumably you didn't get pwned in the process of writing that comment. It's true that securing the execution of untrusted code is hard. But it's not impossible.

Commenting here works just fine without JavaScript.

Re: What Spectre and Meltdown Mean for WebKit

#33

Post by EgoIncarnate »

username223 wrote: post #28
EgoIncarnate wrote: post #24

Earlier quoted context omitted.

Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change anytime soon. So we are stuck with the situation where the defenders (the hardware and software designers) have to be correct 100% of the time on a platform that is constantly changing. The attackers only need to be right once. Maybe someday everything will just be streaming video or something…

> The web by and large requires javascript, and it's not likely to change. While I am mostly a pessimist, this is one place where I harbor a tiny sliver of optimism. Once users recognize that something is awful, and have the means to get rid of it, they eventually do so. Client side Java and Flash are dead, because everyday users figured out that they sucked, and were given the option not to use them. We're getting c…

The users didn't make the decision, the platforms did, and the decision was made after an alternative was available in Javascript.

If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone. All the users did was make popular a platform that didn't support them. If Apple had supported Flash and Java we probably would still have them.

Signed code that users had to install was tried before with ActiveX. It didn't work either because you can't rely on random developers to write secure code either. It's also how IE ended up with Flash. Click here to download Flash (signed by Macromedia).

So basically everything sucks because we're human and make mistakes. Maybe one day we'll have machines that reason more thoroughly than us and they can come up with a secure platform. Until then... Javascript and sandboxes.

Re: What Spectre and Meltdown Mean for WebKit

#34

Post by ams6110 »

> All type checks are also vulnerable. For example, if some type contains an integer at offset 8 while another type contains a pointer at offset 8, then an attacker could use Spectre to bypass the type check that is supposed to ensure that you can’t use the integer to craft an arbitrary pointer.

So, even if WebKit were entirely written in Rust, we'd still be fucked. I'm really starting to think it's about time for me to get out of this business.

Re: What Spectre and Meltdown Mean for WebKit

#35

Post by moz23 »

pizlonator wrote: post #31
username223 wrote: post #5

> WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user’s processor... WebKit is affected by both issues because WebKit allows untrusted code to run on users’ processors. There's the elephant in the room, though this article doesn't go far enough. Trust isn't binary. It's not that the code isn't formally verified, or doesn't t…

And yet presumably you didn't get pwned in the process of writing that comment. It's true that securing the execution of untrusted code is hard. But it's not impossible.

That comment could've been written without executing any Javascript.

// Edit: heh, someone already said the same.

Re: What Spectre and Meltdown Mean for WebKit

#36

Post by bradgessler »

One of the most brilliant features in the latest versions of Safari are per-website settings for ad blockers, notifications, location, etc. Between those two vulnerabilities and the general obnoxious useage of JS on websites, I’d love to see the addition of a per-website setting for JS. I would personally turn it off by default and only whitelist a handful of websites.

Re: What Spectre and Meltdown Mean for WebKit

#37

Post by username223 »

pizlonator wrote: post #31
username223 wrote: post #5

> WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user’s processor... WebKit is affected by both issues because WebKit allows untrusted code to run on users’ processors. There's the elephant in the room, though this article doesn't go far enough. Trust isn't binary. It's not that the code isn't formally verified, or doesn't t…

And yet presumably you didn't get pwned in the process of writing that comment. It's true that securing the execution of untrusted code is hard. But it's not impossible.

I've whitelisted JS from this site, because I "trust" it enough. If HN sold their comment code through some opaque web of third parties, I would be more cautious.

You're clearly an insider, and I'm clearly an outsider, so you understand the nuances here better than I do. What's your concept of securely executing untrusted code? Should users give up control over what runs on their machines? Should they know whose code may run before and/or after it does? Or what data it can or has already exfiltrated?

Re: What Spectre and Meltdown Mean for WebKit

#38

Post by EgoIncarnate »

madez wrote: post #29
EgoIncarnate wrote: post #24

Earlier quoted context omitted.

Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change anytime soon. So we are stuck with the situation where the defenders (the hardware and software designers) have to be correct 100% of the time on a platform that is constantly changing. The attackers only need to be right once. Maybe someday everything will just be streaming video or something…

> Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change. This fatalist stance is childish, and dangerous. As long as there are people working to make things better, things do improve. Sure, if you make sure that one small website works without JavaScript then that doesn't change the world. I hear a similiar argument when I explain why I don't eat…

>> Unfortunately the genie is out of the bottle already. The web by and large requires javascript, and it's not likely to change.

>This fatalist stance is childish, and dangerous. As long as there are people working to make things better, things do improve.

How is it any more of a fatalist stance than the idea that javascript or running untrusted code in a sandbox is fundamentally broken?

Personally I think it's easier and more likely that we attempt to fix a few web browsers than expect millions of websites to change. You might call it fatalism, but I think of it as realism.

>> It's not like users can be relied on to do the right thing all the time anyway.

> So, if you aren't sure you locked the front door of your house, then it also doesn't matter if you left the door to the garden open? Clearly not!

My point was not that security is useless because users are unreliable. My point was that it's better to keep the kids in the sandbox, than to have them play in a busy street. Security should be preserved in spite of users actions, not rely on them.

Re: What Spectre and Meltdown Mean for WebKit

#39

Post by DamonHD »

bradgessler wrote: post #36

One of the most brilliant features in the latest versions of Safari are per-website settings for ad blockers, notifications, location, etc. Between those two vulnerabilities and the general obnoxious useage of JS on websites, I’d love to see the addition of a per-website setting for JS. I would personally turn it off by default and only whitelist a handful of websites.

This is what I already get with FF + NoScript.

And yes, I am bored by sites that I visit for the first time that will not show me any meaningful content until I enable layer upon layer of JS. Just not necessary, nor is it safe.

Re: What Spectre and Meltdown Mean for WebKit

#40

Post by username223 »

EgoIncarnate wrote: post #33
username223 wrote: post #28

Earlier quoted context omitted.

> The web by and large requires javascript, and it's not likely to change. While I am mostly a pessimist, this is one place where I harbor a tiny sliver of optimism. Once users recognize that something is awful, and have the means to get rid of it, they eventually do so. Client side Java and Flash are dead, because everyday users figured out that they sucked, and were given the option not to use them. We're getting c…

The users didn't make the decision, the platforms did, and the decision was made after an alternative was available in Javascript. If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone. All the users did was make popular a platform that didn't support them. If Apple had supported Flash and Java we probably would still have them. Signed code that users had to install was tried befor…

> If anyone killed Flash and Java, it was Apple by refusing to support either on the iPhone.

Apple may have put the nail in the coffin, but long before that quite a few developers and users were avoiding Java programs when there were alternatives, and ClickToFlash was a popular browser plug-in. As they often do, Apple saw which way the wind was blowing.

Post reply on HN