Live data from Hacker News

Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

arstechnica.com

11–20 of 71 posts

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#14

Earlier quoted context omitted.

Yes, I found it interesting that Safari and Firefox are immune. Perhaps this should be framed as another chromium-based exploit rather than a GPU issue.

In this case it's because Chrome supports a relatively obscure use case (GPU-accelerated CSS filters on a cross-origin iframe), it's not really a bug or a vulnerability in the browser.

I mean, Google keeps packing more and more weird nonsense features into Chrome (e.g. https://support.google.com/chrome/answer/6362090?hl=en&co=GE...) so uh...

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#16

But is it really stealing if the owner isn't deprived of use? It's just costless duplication of a nonscarce resource.

The word is used to refer to taking something without the right to do so. The key part is the lack of a right to do so, not depriving the owner. e.g. If you take someone's car while they're away on vacation and bring it back before they get home, it is still stealing, even if you topped up the tank and they never noticed.

Not to derail further, but iirc that’s not the case in most western jurisdictions (“intended to return it after using” is actually a defence against theft charges).

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#17

Earlier quoted context omitted.

Yes, I found it interesting that Safari and Firefox are immune. Perhaps this should be framed as another chromium-based exploit rather than a GPU issue.

In this case it's because Chrome supports a relatively obscure use case (GPU-accelerated CSS filters on a cross-origin iframe), it's not really a bug or a vulnerability in the browser.

Seems like the root reason for wanting accelerated CSS on cross-origin iframe is for flashy/fancy embeds...like, IDK, ads or something?

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#19

But is it really stealing if the owner isn't deprived of use? It's just costless duplication of a nonscarce resource.

The word is used to refer to taking something without the right to do so. The key part is the lack of a right to do so, not depriving the owner. e.g. If you take someone's car while they're away on vacation and bring it back before they get home, it is still stealing, even if you topped up the tank and they never noticed.

Analogies never work.

The reason that it is wrong to take my car, even if I don’t notice, are multiple:

- You are still depriving me of the possibility of using my own car, even if it happened to be the case that I didn’t need it. I could have come home early. I could have told some friend or family to pick up my car so that they could use it. I could have had an appointment that someone would come by to service my car while I was absent. All of this is made impossible if someone takes my car.

- It still causes wear and tear on my car if you use it.

- You could get into an accident, which could hurt you and damage my car.

- I don’t want random strangers to sit their butts in my car.

- etc

Post reply on HN