Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Spectre and Meltdown Mean for WebKit

webkit.org

Post reply on HN
Print view View original

191–200 of 294 posts

Re: What Spectre and Meltdown Mean for WebKit

#191

Post by UweSchmidt »

zero_shift wrote: post #188
UweSchmidt wrote: post #185

Earlier quoted context omitted.

See Netflix, spotify. Those or others will come for content when ads are gone.

But then why haven't "Spotify for Journalism" projects ever worked? How does a business go from $2 per paper to 0.2c per article? Why are so many artists so unhappy with their meagre Spotify royalties? I think this falls under my "proven to scale" condition. [In reply to the below - as we have reached the thread limit: there will _always_ be free competition. The problem is: without advertising, the only players left…

Because there is infinite free / ad-based competition crowding out paid services.

Re: What Spectre and Meltdown Mean for WebKit

#192

Post by madez »

iovrthoughtthis wrote: post #173
madez wrote: post #134

Earlier quoted context omitted.

The notion that there are so many users of digital devices and services because we are running untrusted, unaccounted code that is automatically executed is plain wrong. Hardware advanced in ways we didn't imagine in the past, and interfaces got better. Society learned about computers as they got cheaper and knowledge spread, while better software tools formed, accelerating the growth of the ecosystem. Nothing of tha…

> HTML (or whatever standard we come up with) can be expanded to add the needed features I think it is hubris to think we can ever build a spec with all the needed features. > JavaScript is used to lock us in, exactly what the web shouldn't do. While I agree the web shouldn't lock us in I would like to understand how you think JavaScript does that?

I don't think it is possible to have a spec thats always contains all the latest functionality. But that is also not necessary. The better the spec, the more problems we can solve completely.

I don't think we can always support the newest latest advancement to solve the latest obscure problem, but I think it's no problem to wait a period, even if it were months or years, for it to be standardized and supported in browser. The delay is not a nuisance nor a cost without any benefit. We maintain the open trustable web by doing that.

We have already a pretty good idea of what functionality we need. For example, we can look at what common JavaScript frameworks solve, and think about what we should standardized from that. Nobody did that so far, but we totally could, and should.

Re: What Spectre and Meltdown Mean for WebKit

#193

Post by bakery2k »

Mitigations for Spectre and Meltdown are also being added to the JavaScript VMs in Chrome [1], Firefox [2] and IE/Edge [3].

Are similar mitigations also needed in the VMs for other dynamic languages, such as CPython/PyPy, Ruby MRI and Lua/LuaJIT? What about the JVM and Microsoft's CLR?

Or are these other VMs not susceptible to this form of attack?

[1] https://www.chromium.org/Home/chromium-security/ssca

[2] https://blog.mozilla.org/security/2018/01/03/mitigations-lan...

[3] https://blogs.windows.com/msedgedev/2018/01/03/speculative-e...

Re: What Spectre and Meltdown Mean for WebKit

#194

Post by TeMPOraL »

madez wrote: post #189
TeMPOraL wrote: post #166

Earlier quoted context omitted.

This fight is about money, because you're going against the entire industry, asking some players in it to self-sacrifice. > Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it. For a short while, maybe, but as people making websites don't care about minority browsers, the amount of important websites you wouldn't be able to use through that browser would only grow,…

It is not about making everybody stop doing user-hostile activites. That is my main point here, it is not about that. There are people who have a website and don't want to monetize the visitors. I want a standardized web for them. Not everbody has to belong to that group for it to have merit. I don't expect Microsoft or Google to stop making their online office stuff. Honestly, I couldn't care less what they are doin…

If that - just that - is your scope, then count me in.

I'd love to have a "standard web" that's entirely focused on providing visitors information in an efficient manner. And by efficient I mean not fighting attempts at providing better UIs or aggregating information through machine methods.

Re: What Spectre and Meltdown Mean for WebKit

#195

Post by krapp »

madez wrote: post #189
TeMPOraL wrote: post #166

Earlier quoted context omitted.

This fight is about money, because you're going against the entire industry, asking some players in it to self-sacrifice. > Having one modern browser ditch JavaScript would already be a huge win, and people who care could use it. For a short while, maybe, but as people making websites don't care about minority browsers, the amount of important websites you wouldn't be able to use through that browser would only grow,…

It is not about making everybody stop doing user-hostile activites. That is my main point here, it is not about that. There are people who have a website and don't want to monetize the visitors. I want a standardized web for them. Not everbody has to belong to that group for it to have merit. I don't expect Microsoft or Google to stop making their online office stuff. Honestly, I couldn't care less what they are doin…

Not everyone who uses javascript does so to monetize visitors. It's just a scripting language, it can be used for anything - and any user or publisher who doesn't want to use it already has the freedom not to.

Re: What Spectre and Meltdown Mean for WebKit

#196

Post by xtanx »

krapp wrote: post #167
cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

> no one is saying we should deactivate native apps written in unsafe languages

No we should definitely not, but we should encourage using something like rust or whatever comes after rust.

Re: What Spectre and Meltdown Mean for WebKit

#197

Post by _0w8t »

bennofs wrote: post #170
_0w8t wrote: post #165

It is not clear from the article how WebKit avoids changing semantics with array index masking. In JS out-of-bounds access should return undefined, not a random element of the array. To preserve that a branch still has to be made.

If you combine index masking with a branch that should still be Ok. For example, if you do `if(idx > arrayLength) return undefined else array[idx & mask]` then the CPU can only predict "return undefined" or "array[idx & mask]", none of which can cause any harm.

Does that imply that WebKit always allocate by power of two and a script cannot read the memory for unrelated allocation between the array length and the nearest 2n?

Re: What Spectre and Meltdown Mean for WebKit

#198

Post by cm2187 »

krapp wrote: post #167
cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website. The only c/c++ code is code I downloaded and installed or that my OS vendor trusted to include in the OS. It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.

Re: What Spectre and Meltdown Mean for WebKit

#199

Post by madez »

krapp wrote: post #195
madez wrote: post #189

Earlier quoted context omitted.

It is not about making everybody stop doing user-hostile activites. That is my main point here, it is not about that. There are people who have a website and don't want to monetize the visitors. I want a standardized web for them. Not everbody has to belong to that group for it to have merit. I don't expect Microsoft or Google to stop making their online office stuff. Honestly, I couldn't care less what they are doin…

Not everyone who uses javascript does so to monetize visitors. It's just a scripting language, it can be used for anything - and any user or publisher who doesn't want to use it already has the freedom not to.

I agree, and I think it is a pity that JavaScript is necessary for a lot of useful functionality which could be standardized to be made available without JavaScript, so people who care can browser the web and their sites in a browser that doesn't support JavaScript and still have a rich experience.

Re: What Spectre and Meltdown Mean for WebKit

#200

Post by krapp »

madez wrote: post #199
krapp wrote: post #195

Earlier quoted context omitted.

Not everyone who uses javascript does so to monetize visitors. It's just a scripting language, it can be used for anything - and any user or publisher who doesn't want to use it already has the freedom not to.

I agree, and I think it is a pity that JavaScript is necessary for a lot of useful functionality which could be standardized to be made available without JavaScript, so people who care can browser the web and their sites in a browser that doesn't support JavaScript and still have a rich experience.

What benefit would there be to doing that? If the functionality remains the same, you've just transferred Turing completeness somewhere else.

I can see the benefit to having languages other than javascript run in the browser, though, but the only way there seems to be WebAssembly.

Post reply on HN