What Spectre and Meltdown Mean for WebKit

Post by Can_Not » Wed, Jan 10, 2018, 1:22 PM UTC

Nursie wrote: post #225

krapp wrote: post #167

Earlier quoted context omitted.

> I wonder if this shouldn't question whether we should still allow all websites to run javascript by default. Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages, or not allow anyone to program a GUI unless they can justify the use of canvas space. Yet the web, arguably the most successful and free (as in both beer and freedom) and access…

>> Plenty of harmful things are done with C and C++ but no one is saying we should deactivate native apps written in unsafe languages This is not in any way equivalent to browsing an informational site and having arbitrary code execute. >> Yet the web ... is the only one on which people - erstwhile hackers - say that code should be a considered a privilege and not a right, Hell no, code execution is a privilege in al…

Post by 0x7f » Wed, Jan 10, 2018, 9:11 PM UTC

pizlonator wrote: post #284

0x7f wrote: post #280

Earlier quoted context omitted.

I think this part is misleading => "Spectre means that an attacker can control branches, so branches alone are no longer adequate for enforcing security properties." I think they meant "Spectre means an that attacker can ABUSE branches", and in that they are right.

This is clarified later: “Spectre means that branches are no longer sufficient for enforcing the security properties of read operations in WebKit.“ It’s totally true that Spectre allows attackers to control reads, but when they do this, they enter a non-destructive execution mode. They can read but anything they write is thrown away. (To our knowledge, lol.)