Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Spectre and Meltdown Mean for WebKit

webkit.org

Post reply on HN
Print view View original

151–160 of 294 posts

Re: What Spectre and Meltdown Mean for WebKit

#151

Post by letsgetphysITal »

littlestymaar wrote: post #148
cabalamat wrote: post #119

Earlier quoted context omitted.

> Instead of neutering the web If you took JSW off of most websites, it wouldn't be neutering the web it'd be making it better.

A taxidermist could argue that dead animals are better than living ones : they are indeed more convenient, less dangerous and cheaper to feed. But they aren't animal anymore, are they ?

Absolutely true. However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised.

Any other daft analogies you want to use?

Re: What Spectre and Meltdown Mean for WebKit

#152

Post by littlestymaar »

duozerk wrote: post #94
cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

Unless you're considering client-side encryption, I don't think webmails qualify either (squirrelmail, for example, works pretty well without JS).

Indeed because auto-complete of recipient address from my contacts is useless, right ? Same could be said for retrieving new emails without reloading the page I guess …

Had JavaScript not existed, the web would be dead a long time ago already.

Re: What Spectre and Meltdown Mean for WebKit

#153

Post by littlestymaar »

letsgetphysITal wrote: post #151
littlestymaar wrote: post #148

Earlier quoted context omitted.

A taxidermist could argue that dead animals are better than living ones : they are indeed more convenient, less dangerous and cheaper to feed. But they aren't animal anymore, are they ?

Absolutely true. However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised. Any other daft analogies you want to use?

Your stuffed cat could not, but a living cat could bring you rabies if some third party in your neighborhood got infected, that's my point ;).

Re: What Spectre and Meltdown Mean for WebKit

#154

Post by vog »

dingo_bat wrote: post #126
vog wrote: post #114

Earlier quoted context omitted.

More security experts would be encouraged to have a look at the design and to find flaws early on. Of course, we all know that this doesn't always happen, see OpenSSL. However, once a major incident (Heartbleed) happened, they did: Many more OpenSSL issues were found and fixed, forks with different trade-offs came into place. For example, LibreSSL traded backwards compatibility with ancient systems for a smaller code…

But these attacks (Meltdown/Spectre) are on a fundamental design approach, which was conceived and developed and researched in the open. People in colleges all over the world study about them. Do you really think this would have been caught much sooner is Intel had released all schematics and layouts to the public?

I'm just saying that in general, the incentive for a scientist to put work into an open system is orders of magnitude higher than to put work into a closed system.

To provide a similar example:

The crypto experts around Daniel J. Berstein and Tanja Lange stated publicly at 34C3 that they refused to perform crypto analysis on a certain algorithm that was patented. But they (and others) published good crypto analysis results (working attacks!) just a few months after the patent expired.

Re: What Spectre and Meltdown Mean for WebKit

#155

Post by TeMPOraL »

send_computers wrote: post #129
dingo_bat wrote: post #100

Earlier quoted context omitted.

> There are websites that genuinely need to run some code, like webmails, Not really, not if you think about it. Webmail doesn't need anything more than html( > online trading platforms Ditto. > online games Honestly, I think running webgames in a super-sandboxed flash (or similar) runtime is the best thing to do. Again, no use for js on the web.

Yeah lets all just use bash commands to browse the web, way more secure and sure you can get the information you need... oh wait wasn't that 20 years ago?

And it would still be possible if web standards didn't accrue so many capabilities that allowed people to treat them as a new medium of publishing color magazines (with invasive tracking as a cherry on the cake).

Re: What Spectre and Meltdown Mean for WebKit

#156

Post by EgoIncarnate »

pjmlp wrote: post #143
EgoIncarnate wrote: post #111

Earlier quoted context omitted.

I don't think WebAssembly is going to bring back Flash or Java Applets in any meaningful way. Maybe someone will hack something together and use it for niche old Flash game sites, but it's hard to see a reason for widespread adoption of anything new. People have moved on. Flash and Java Applets may not be "dead" forever, but they also are not likely to ever be more than undead zombies.

Again, not paying attention to the news. http://teavm.org/ https://forums.adobe.com/thread/2432179 http://www.mono-project.com/news/2017/08/09/hello-webassembl... https://www.hanselman.com/blog/NETAndWebAssemblyIsThisTheFut... https://github.com/Microsoft/xaml-standard/issues/197

I think we are talking about different things. Half your links have nothing to do with Flash or Java Applets (.net, XAML?).

You seem to be talking about new platforms that may derive some part from the old. I'm not saying WebAssembly won't be used for new platforms as that's sort of the whole point of it.

What I'm saying is that WebAssembly won't bring back people making Flash .swfs or writing classes derived from java.applet.Applet in any mainstream way. In that sense Flash and Java Applets are dead. Maybe someone will hack something together that allows you to run them, but that won't bring the developers back to the old platforms.

If Oracle or Adobe announce something, maybe the industry will jump on board, but currently I don't see anything in your list that makes me change my mind about Flash and Java Applets being dead and not coming back.

Re: What Spectre and Meltdown Mean for WebKit

#157

Post by TeMPOraL »

madez wrote: post #138
stesch wrote: post #107

Earlier quoted context omitted.

It's too late. For many years (decades?) I got downvoted (here and on Reddit) for mentioning that I used NoScript. I even disabled JavaScript completely on Netscape Navigator. It was in the context of sites that were unusable without JavaScript or security problems that only affected JavaScript in browsers.

It's too late for what? Sure, Google and other advertising companies will never stop pushing technologies that are favourable for them, but we don't have to use them. We can always build open and free alternatives.

It doesn't matter. The playing field itself allows for shitty practices, and people/companies engaging in those shitty practices get more profit than those who refrain from it.

As long as shitty practices are supported by the browsers general population uses, nothing will really change.

Re: What Spectre and Meltdown Mean for WebKit

#159

Post by dingo_bat »

om2 wrote: post #133
dingo_bat wrote: post #100

Earlier quoted context omitted.

> There are websites that genuinely need to run some code, like webmails, Not really, not if you think about it. Webmail doesn't need anything more than html( > online trading platforms Ditto. > online games Honestly, I think running webgames in a super-sandboxed flash (or similar) runtime is the best thing to do. Again, no use for js on the web.

Built-in JavaScript has a better security track record than Flash and it’s ActionScript engine.

That's true, but probably only because writing games and animations in js is sooooooooooo much harder than doing the same in flash.

Re: What Spectre and Meltdown Mean for WebKit

#160

Post by zingmars »

littlestymaar wrote: post #153
letsgetphysITal wrote: post #151

Earlier quoted context omitted.

Absolutely true. However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised. Any other daft analogies you want to use?

Your stuffed cat could not, but a living cat could bring you rabies if some third party in your neighborhood got infected, that's my point ;).

So your point is that we _should_ JavaScript?
Post reply on HN