Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge Experimenting with a Super Duper Secure Mode

microsoftedge.github.io

Post reply on HN
Print view View original

11–20 of 67 posts

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#11

Post by tinus_hn »

asiachick wrote: post #6
tinus_hn wrote: post #4

Interesting but I am not a fan of how they don’t mention disabling features like WebAssembly in the short description.

they did mention it in the long description. It's off for now but they are planning on turning it on. I'd guess it's safer than JIT because the translation to assembly is simple, or can be simple. It's not trying to do the complicated process of analyzing a dynamically typed language and applying different ways of optimizing.

I’m sure there’s a great reason but the policy description reads like ‘turn this on for more security and no important downsides’

> Disables the JIT and enables new security mitigations to provide a more secure browsing experience - Windows

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#12

Post by vladvasiliu »

Retr0id wrote: post #10
hawk_ wrote: post #9

Earlier quoted context omitted.

I know where you're going but this can easily turn upcoming players into second class, further reinforcing big tech monopoly.

Assuming "trusted websites" is a user preference, why should it matter?

Because "defaults are forever" or something like that.

Most people won't alter those settings, so whatever is "trusted by default" will run faster. The average user will just note that some sites are very fast, while others are very slow.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#13

Post by cube00 »

omk wrote: post #7
habitue wrote: post #5

Earlier quoted context omitted.

Well, like the real reason is that the web is a threat to the app store. So, likely we'd just see some new excuse (if they even bother)

Ironically, in the early days Apple was redirecting developers to the web to build apps for the iPhone. But then it seems they discovered a money minting model.

Along with a vendor lock in model

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#14

Post by kenny11 »

beefjerkins wrote: post #3

I'm surprised at how little regressions there were in the tests they run, given they completely disabled JIT. This could be very useful as a default 'mode' for websites, with JIT able to be turned on for trusted websites if the user would like more performance.

Or maybe instead of trusted websites they'll move to a model where you need digital signatures on your JavaScript code to enable high-performance mode, just like you need to code sign Windows applications to avoid scary warnings about what they might do to your computer.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#18

Post by fwsgonzo »

This reminded me of my experience handling the frontend side of Varnish using a RISC-V emulator. The most important thing is that the emulator is quick to bring up and quick to tear down. Almost zero syscall (10ns) and vmcall (4ns) overhead. So, if nobody is doing any heavy computation, the most important things are getting the base overheads down. For example, the RISC-V emulator could handle the full frontend pipeline side in less than 1 microsecond. That's going to be hard to beat. I wonder if the same could apply to a standard website for a simpler kind of WebAssembly emulator instead of JavaScript? And by that, I mean replacing JavaScript with WebAssembly completely, and just make all the tooling necessary to make it nice and easy.

Re: Microsoft Edge Experimenting with a Super Duper Secure Mode

#20

Post by nicce »

heisenbit wrote: post #16

Web pages where compilation costs and benefits are short may be one thing. But what about cached code? And what about real applications running in the browser?

We have come a long road to establish transparent protocols to run stuff on our browsers (HTML, JavaScript, CSS, JSON, HTTP protocol), yet we are going to towards compiled binary code, towards black-box schema.

The users will have less power of the content on their browsers with compiled code and something like ad blockers become challenging to implement again. I'm not really big fan of this trend. For example Google Docs is being rewritten to use canvas and who knows what it actually does behind the scenes.

Post reply on HN