101–110 of 365 posts
Earlier quoted context omitted.
It's could be unfixable without a significant performance penalty, but at minimum they could make safari do proper process isolation like every other browser does.
I could easily imagine such a refactor of Safari taking more than 90 days even if Apple made it the highest possible priority.
Earlier quoted context omitted.
Serious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.
Will that work? Isn't memory treated in a unified way between processes, at some point?
Earlier quoted context omitted.
I could easily imagine such a refactor of Safari taking more than 90 days even if Apple made it the highest possible priority.
The bug is open since 2018, so clearly they don’t actually care about that. https://bugs.webkit.org/show_bug.cgi?id=184466
Earlier quoted context omitted.
Is it bad that I disable spectre mitigations on all my PCs to get a free double-digit-% performance boost?
You're not getting a boost, you're avoiding a penalty. In some (but not all) cases you can avoid the penalty and the exploits by disabling SMT. Remember, SMT isn't twice as many cores, just twice as many half-cores. You'll be fine.
Earlier quoted context omitted.
It's super feasible if you own the API default.
You just announce you are making a change and then turn it on later.
They just won’t, and you’ll have a browser that people stop using.
Earlier quoted context omitted.
Serious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.
Will that work? Isn't memory treated in a unified way between processes, at some point?
Earlier quoted context omitted.
Multithreading may be an obscure feature to you but runtime developers get requests for it all the time. SAB becoming widely available was definitely delayed.
I would still maintain that needing multithreading on a website is relatively rare, and specifically needing SharedArrayBuffer instead of just multiple proceses (e.g. webworkers) is even more rare. Did use cases exist? Sure. But not sufficiently to move the needle on app store usage.
Web games benefit significantly from SAB (see the Godot engine for example) and mobile games make up a pretty sizable chunk of app store usage, particularly in app purchases.
Earlier quoted context omitted.
"trivial" how do you figure? Remember these exploits bypass your own code's conditionals over a shockingly far duration. Unless you just mean for incredibly restrictive usages such as eBPF? possible absent any performance concerns at all, yeah sure
> Unless you just mean for incredibly restrictive usages such as eBPF? I was actually thinking something more like a bytecode interpreter that runs one operation and then sleeps until the next full wall clock second, but yes, that's my point: If you don't care about performance, you can make process isolation safe very easily.
Aside: I feel like RUB has become kind of a global center for this kind of high-end offensive security work. Was I just not paying enough attention 10 years ago or is this a new-ish thing?
Earlier quoted context omitted.
That's not a failure of Safari, it's required by window.open API semantics, in particular by the default Cross-Origin-Opener-Policy of "unsafe-none" [1]. By setting a different policy, sites can protect themselves against this. I guess technically browsers could open new windows in a new browsing context group regardless of this setting and relay the allowed types of messages via IPC (if any), but that would be a maj…
Other browsers do site isolation, why can’t Safari? (: