Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Spectre and Meltdown Mean for WebKit

webkit.org

Post reply on HN
Print view View original

161–170 of 294 posts

Re: What Spectre and Meltdown Mean for WebKit

#161

Post by EgoIncarnate »

pjmlp wrote: post #145
EgoIncarnate wrote: post #117

Earlier quoted context omitted.

Would you consider yourself a typical example of a naive user? The security default needs to work for everyone. I think the sandbox approach is better than expecting everyone to correctly decide when it is or isn't okay to allow a site to run code.

Yes in the context of iOS, Android and UWP native apps.

You must run in much better circles than I do. Nevermind a naive user, the average users I know wouldn't know how to disable javascript, or whitelist sites, or that there even were sandbox settings in the OS.

Some of the older people I know can't even correctly choose between between writing a text message, and a facebook post.

If you think you are a typical example of a naive user, I would hate to see what you expect of the average user.

Re: What Spectre and Meltdown Mean for WebKit

#162

Post by PuffinBlue »

zingmars wrote: post #160
littlestymaar wrote: post #153

Earlier quoted context omitted.

Your stuffed cat could not, but a living cat could bring you rabies if some third party in your neighborhood got infected, that's my point ;).

So your point is that we _should_ JavaScript?

Who knows! This comment thread is so wrapped up in its own analogy i just stuffed my cat full of JavaScript.

Re: What Spectre and Meltdown Mean for WebKit

#163

Post by madez »

TeMPOraL wrote: post #157
madez wrote: post #138

Earlier quoted context omitted.

It's too late for what? Sure, Google and other advertising companies will never stop pushing technologies that are favourable for them, but we don't have to use them. We can always build open and free alternatives.

It doesn't matter. The playing field itself allows for shitty practices, and people/companies engaging in those shitty practices get more profit than those who refrain from it. As long as shitty practices are supported by the browsers general population uses, nothing will really change.

Money doesn't win every fight. And not every fight is about money. For example, Mozilla is a non-profit organization. It's not about making everybody stop doing the wrong thing, it's about doing the right thing. Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it. If Mozilla pushed the open web, it would already be much better, because all those open projects could use that. Not everybody uses Googles or Facebooks websites.

Re: What Spectre and Meltdown Mean for WebKit

#164

Post by LaGrange »

epenance wrote: post #98
cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

This is false. Many websites are using Javascript to render the websites in full to give the users a better experience, such as rendered a SPA (Single-Page-Application) to prevent unneeded amounts of data loaded on each page request and only load exactly what you need, to give a faster, smoother and higher quality experience for the user. Sure the mom down the street who wants to blog about the her kitchen recipes wo…

If you took away JS from Facebook and Twitter, they'd literally be a better experience. They'd be forced to give up much of what makes them painful to use. At least Twitter had a character counter, that was a useful JS feature, but they broke even that.

And if you need a diagraming tool, maybe a website isn't the best solution.

Re: What Spectre and Meltdown Mean for WebKit

#165

Post by _0w8t »

It is not clear from the article how WebKit avoids changing semantics with array index masking. In JS out-of-bounds access should return undefined, not a random element of the array. To preserve that a branch still has to be made.

Re: What Spectre and Meltdown Mean for WebKit

#166

Post by TeMPOraL »

madez wrote: post #163
TeMPOraL wrote: post #157

Earlier quoted context omitted.

It doesn't matter. The playing field itself allows for shitty practices, and people/companies engaging in those shitty practices get more profit than those who refrain from it. As long as shitty practices are supported by the browsers general population uses, nothing will really change.

Money doesn't win every fight. And not every fight is about money. For example, Mozilla is a non-profit organization. It's not about making everybody stop doing the wrong thing, it's about doing the right thing. Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it. If Mozilla pushed the open web, it would already be much better, because all those open projects could…

This fight is about money, because you're going against the entire industry, asking some players in it to self-sacrifice.

> Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it.

For a short while, maybe, but as people making websites don't care about minority browsers, the amount of important websites you wouldn't be able to use through that browser would only grow, until the point that browser becomes useless.

People making money off user-hostile activities won't voluntarily stop making money off user-hostile activities.

Re: What Spectre and Meltdown Mean for WebKit

#167

Post by krapp »

cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default.

Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and accessible software platform yet devised, is the only one on which people - erstwhile hackers - say that code should be a considered a privilege and not a right, or that it doesn't really belong on the web at all, despite javascript being on the web for ~20 years now.

What you're describing seems a lot like adding Windows UAC prompts to the web - no one would find that better, particularly given that anyone can simply turn javascript off in their browser already. This isn't even a javascript problem per se - you could erase javascript from the universe and make the web as plain as you like and Spectre and Meltdown would still exist.

> also at the very least it should lead us to question the chain of trust of javascript. When I visit abc.com I should only execute javascript from abc.com or a subdomain. No script either hosted on a non abc.com domain or appearing in an iframe should be executed.

That seems reasonable, and I would be willing to bet, possible to configure with modern tools. But pretending javascript is a second-class citizen on the web isn't the answer.

Re: What Spectre and Meltdown Mean for WebKit

#168

Post by zero_shift »

cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

> An ecommerce, a newspaper or a blog should have no reason to execute client side code to render.

The main reason is advertising, which is ultimately how this web content is paid for.

But there could be alternatives. We could create static img elements that could securely and discretely record whether they were viewed by a human (to prevent ad fraud). We could support simple animations and interactivity in a secure, resource-friendly way. And we could allow these to be disabled by user agents (e.g. epileptics).

Could newspapers exist without online advertising? Possibly, but only in specialised niches. Consumers have shown that they will always seek the cheapest, most accessible forms of information - even when provided by highly biased, unreliable sources.

The danger to killing online advertising is that it creates a world where the only people who can afford to publish are those with other interests - plutocrats, politicians, churches - and who will inevitably bankroll news only to further political ends.

Re: What Spectre and Meltdown Mean for WebKit

#169

Post by bennofs »

littlestymaar wrote: post #144
cm2187 wrote: post #118

Earlier quoted context omitted.

No, drop down menus, pre-validation of forms, adaptive rendering are the daily experience. Javascript is just the way we currently achieve that. I argue that a better html would avoid having to do this in javascript, as these are standard features that are needed everywhere. And even if Intel comes up with a new design available for sale next month, we will still be stuck for many years with this flaw on all the devi…

> No, drop down menus, pre-validation of forms, adaptive rendering are the daily experience. Javascript is just the way we currently achieve that. I argue that a better html would avoid having to do this in javascript, as these are standard features that are needed everywhere. You can certainly standardize a certain set of feature and put them in a non-turing-complete language like HTML, but standardizing all the leg…

> non-turing-complete language like HTML

I would be careful about that: It wouldn't suprise me if HTML with CSS (at least with all the new things like animations) is turing complete (it probably is).

Re: What Spectre and Meltdown Mean for WebKit

#170

Post by bennofs »

_0w8t wrote: post #165

It is not clear from the article how WebKit avoids changing semantics with array index masking. In JS out-of-bounds access should return undefined, not a random element of the array. To preserve that a branch still has to be made.

If you combine index masking with a branch that should still be Ok. For example, if you do `if(idx > arrayLength) return undefined else array[idx & mask]` then the CPU can only predict "return undefined" or "array[idx & mask]", none of which can cause any harm.
Post reply on HN