121–130 of 294 posts
Earlier quoted context omitted.
> not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.
I'm continually shocked that people are so ok with automatically executing any code random sites they connect to shove at them.
Earlier quoted context omitted.
“Close browser tab” - immediately exits a Google Meet. Closing a Zoom/Webex meeting, who knows since it’s still running in the background. I also like meetings sandboxed in a browser so weird things like “automatically take control of your screen and maximize window” doesn’t happen when someone in a Zoom meeting starts sharing their screen. Even at the expense of more CPU.
That meme with the actor taking to a bloodied Jesus comes to mind while reading you guys comparing google with zoom. You guys are so lucky. I work on Skype for Business over a Citrix Workspace connection. While Skype is an unmitigated disaster that can’t do simple stuff like copying text there is Citrix that requires a wizard installer with admin rights that deploys 3 background services and requires an audio plugin…
It's not Citrix doing this, but your administrator.
Earlier quoted context omitted.
your desktop is already rooted by Zoom
And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation. Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Micro…
Maybe a Win10 Home, or some other version? Or was that in a search result (or ad) not actually Windows?
Earlier quoted context omitted.
That meme with the actor taking to a bloodied Jesus comes to mind while reading you guys comparing google with zoom. You guys are so lucky. I work on Skype for Business over a Citrix Workspace connection. While Skype is an unmitigated disaster that can’t do simple stuff like copying text there is Citrix that requires a wizard installer with admin rights that deploys 3 background services and requires an audio plugin…
The inability to copy text may be due to an admin setting. At my previous workplace they disabled the ability to paste in images, etc. into Skype for Business saying that it was a security risk. They also disabled the ability to copy and paste between apps except within MS Office for the same reason. It's not Citrix doing this, but your administrator.
Earlier quoted context omitted.
I suspect our heavy reliance on speculative execution is just a local optimum, and we can grow out of it by providing the processor more information about the data flow, making memory access more explicitly asynchronous, and simplifying the hot paths. I like the way the mill approaches these architectural problems.
Is the Mill dead? I've not seen the regular flow of HN posts about it recently. Everyone got excited about RISC-V instead.
https://millcomputing.com/topic/on-the-lack-of-progress-repo...
Earlier quoted context omitted.
Mitigations for inter-process side channels address the issue of local applications attacking each other. That includes your web browser, the JS in it, or any other ad-laden crapware attack your local applications, e.g. to steal credit cards, SSH keys, etc. Side-channels are pernicious. In the limit, they give applications unfettered read access across protection boundaries. If we don't shut them down, we might as we…
> 4KB/s (basically dialup speed) I guess if "basically" means "takes 10x longer"?
(I don't know if dial-up is still 56 kb/s these days, but that's the speed historically associated with the term.)
Earlier quoted context omitted.
/second NoScript. Instead of whitelisting whole sites, you can whitelist links to JavaScript imports across all sites, temporarily or permanently. So for example, you can whitelist urls to all the major JavaScript frontend frameworks’ CDNs, like bootstrap, etc. while leaving known trackers and spyware blacklisted by default. Anecdotally it seems most websites still work with their trackers disabled, as long as they h…
I disagree. There are way too many sites that require javascript that you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.
Which is why I just use basic ublock origin and regulary wipe the browser cache.
Earlier quoted context omitted.
Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.
Yeah no disagreement there. I had totally forgotten about the JS POC - ugh! The JavaScript argument is interesting to me in that it's already flawed. I suppose I'd rather focus on the security issues with browsers running code on my computer more than anything else since it's effectively the "but what about ___" answer to so many threads like this one. I've seen a few other comments suggesting per-process rules to en…
Also, I wonder if disabling mitigations on the desktop and running the browser in a VM with mitigations enabled would be effective.
Earlier quoted context omitted.
> I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Turning off speculative execution reduces performance enormously . Yes, code is often less efficient than it could be but "surprise, you need 5x as large of a datacenter because your hardware isn't doing fancy stuff" is not going to…
I suspect our heavy reliance on speculative execution is just a local optimum, and we can grow out of it by providing the processor more information about the data flow, making memory access more explicitly asynchronous, and simplifying the hot paths. I like the way the mill approaches these architectural problems.
Earlier quoted context omitted.
And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation. Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Micro…
I run Windows 10 (Home) since years and the OS has so far, never tried to warn me about Firefox. It does however reset default browser back to Edge after biannual major OS upgrades. Also searching 'adblock for Firefox' on Google returns several results from Mozilla addons for me. Chrome is not linked anywhere on the first page of results. What is personally more annoying is Edge keeps randomly popping up a banner ask…
Haha, ... when you apply that standard to the modern world - you sometimed wish the stoneage back.
Seriously, there is something deeply wrong with society, when all this shit just gets accepted by everyone.
"Telemetry" such a innocent word. If they would write we record allmost everything you do on your computer and send that data to wherever we want to .. I doubt much would actually change, as MS office software is still mandatory in many places, but maybe there would be more awareness of it.