Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Spectre and Meltdown Mean for WebKit

webkit.org

Post reply on HN
Print view View original

201–210 of 294 posts

Re: What Spectre and Meltdown Mean for WebKit

#201

Post by gpderetta »

om2 wrote: post #140
gpderetta wrote: post #96

Earlier quoted context omitted.

If browsers are careful not to put any sensitive information in the same process that is executing JS code, sandboxing could work. This seems a sensible thing anyway as it would mitigate other attacks as well. Allocating one process for JS-using webpage is expensive though.

Chrome is working towards something like this with Site Isolation, and it’s a good idea. Unfortunately it’s not a complete defense. First, web pages can load cross origin resources, and that may be enough to get data or a cookie into the attacker’s web process. Second, some risks of this attack (e.g. ASLR bypass) don’t require any data from another origin to be in process to be dangerous.

> web pages can load cross origin resources

I know nothing about web technologies, but maybe this is something we should stop doing, at least for any executable resource? This would prevent JS ads I guess, so win/win?

> Second, some risks of this attack (e.g. ASLR bypass) don’t require any data from another origin to be in process to be dangerous.

yes, ASLR seems to be busted.

Re: What Spectre and Meltdown Mean for WebKit

#202

Post by jpttsn »

EgoIncarnate wrote: post #104
jpttsn wrote: post #93

Earlier quoted context omitted.

Not sure it’s a genie situation. Look at Java applets, Flash player.

The situation is apples and oranges. Dumping Flash and Java took years, and was driven by rapid adoption of mobile devices that either didn't support them at all (Apple) or very well (everyone else). There was an already deployed alternative (Javascript). Javascript is buried much deeper in modern websites and would be much more difficult to replace than either Flash or Java Applets were for most sites. For most site…

Big changes do happen and look small only in retrospect.

Re: What Spectre and Meltdown Mean for WebKit

#203

Post by krapp »

cm2187 wrote: post #198
krapp wrote: post #167

Earlier quoted context omitted.

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website. The only c/c++ code is code I downloaded and installed or that my OS vendor trusted to include in the OS. It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.

>Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website.

It does every time you run a native application, for the same values of "random, unexpected and untrusted."

>It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.

Fine. Turn it off then. That's an option you don't really have in any other runtime, so take advantage of it. But just because you don't want javascript on the web doesn't mean it doesn't belong there when authors choose to include it as part of the content they serve.

Also, how exactly does one run "3rd, 4th or 5th party" javascript?

Re: What Spectre and Meltdown Mean for WebKit

#204

Post by madez »

krapp wrote: post #200
madez wrote: post #199

Earlier quoted context omitted.

I agree, and I think it is a pity that JavaScript is necessary for a lot of useful functionality which could be standardized to be made available without JavaScript, so people who care can browser the web and their sites in a browser that doesn't support JavaScript and still have a rich experience.

What benefit would there be to doing that? If the functionality remains the same, you've just transferred Turing completeness somewhere else. I can see the benefit to having languages other than javascript run in the browser, though, but the only way there seems to be WebAssembly.

The advantage of not supporting programming languages in the browser from content that comes from servers is that one doesn't accidentally fall into that trap.

The functionality in my browser is important. The more the browser is scriptable, the better, but not from the website.

The code on my machine is reviewed, vetted, accounted, maintained and free. That is the big difference.

Re: What Spectre and Meltdown Mean for WebKit

#205

Post by cm2187 »

krapp wrote: post #203
cm2187 wrote: post #198

Earlier quoted context omitted.

Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website. The only c/c++ code is code I downloaded and installed or that my OS vendor trusted to include in the OS. It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.

>Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website. It does every time you run a native application, for the same values of "random, unexpected and untrusted." >It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit. Fine. Turn it off then. That's an option you don't real…

> Also, how exactly does one run "3rd, 4th or 5th party" javascript?

You load a page that includes 3rd party scripts/iframes that themselves load 4th party scripts that themselves load 5th party scripts, etc. You often notice that when you start blocking an ad in your browser and suddenly 10 others disappear at the same time.

Re: What Spectre and Meltdown Mean for WebKit

#206

Post by UncleEntity »

krapp wrote: post #167
cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

> ...say that code should be a considered a privilege and not a right, or that it doesn't really belong on the web at all, despite javascript being on the web for ~20 years now.

Same could be said about advertising and I'm infringing on all these innocent corporations' natural rights by running an adblocker.

For random code to run on my machine a few (IMHO reasonable) steps need to happen: 1) somehow entice me to click on a link 2) get past AdBlock 3) get past Privacy Badger

Seems like a privilege to me --and I'm not someone who cares all that much about the shenaganians the big webcorps get up to since I have no money so spend on their ad campaigns anyway.

Re: What Spectre and Meltdown Mean for WebKit

#207

Post by seba_dos1 »

cm2187 wrote: post #198
krapp wrote: post #167

Earlier quoted context omitted.

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website. The only c/c++ code is code I downloaded and installed or that my OS vendor trusted to include in the OS. It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.

No. Unless the application downloads and executes new code from third parties neither you nor application author can control every time you launch it, it's absolutely not comparable to most of the websites.

Re: What Spectre and Meltdown Mean for WebKit

#208

Post by alien_at_work »

krapp wrote: post #167
cm2187 wrote: post #92

I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. There are websites that genuinely need to run some code, like webmails, online trading platforms, online games, etc. But 99% of the websites have no good reason to do so. Javascript is used to make up for the shortcomings of html/css (different rendering for different screen sizes, lack of local validation of…

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

>Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages,

That's not remotely a valid comparison. If I run a native app, I had to get that app somehow and install it. I know it can modify my computer (and probably have to give it persmission to do so). A web page can automatically load other pages, even in the background and do who knows what. For most of the existance of the web we've all had the mental model of "sandbox". We never had that for native apps.

Re: What Spectre and Meltdown Mean for WebKit

#209

Post by UncleEntity »

letsgetphysITal wrote: post #151
littlestymaar wrote: post #148

Earlier quoted context omitted.

A taxidermist could argue that dead animals are better than living ones : they are indeed more convenient, less dangerous and cheaper to feed. But they aren't animal anymore, are they ?

Absolutely true. However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised. Any other daft analogies you want to use?

> However, I'm not also not likely to find my stuffed cat slowed to a crawl and using all my electricity by mining Bitcoin because some 3rd party advertising network got compromised.

You obviously need to upgrade your stuffed cat...

Re: What Spectre and Meltdown Mean for WebKit

#210

Post by seba_dos1 »

send_computers wrote: post #130
xtanx wrote: post #127

Earlier quoted context omitted.

The statement "a better experience" is debatable. I cannot remember how many times I have visited SPA websites that break the browser url history. Also, if a SPA fails to load a request for any reason, try reloading it. Ops you start over. And I am not talking about some people that don't know what they are doing. At times I've had issues with Google's new developer console, gsuite admin, analytics, product hunt and…

These are all examples of bugs or badly designed/coded applications. Don't blame JS for bad coding...

But it's really really really hard to not do bad code in JS - a whole ecosystem seemingly built to encourage terribleness.
Post reply on HN