What Spectre and Meltdown Mean for WebKit
1–10 of 294 posts
Re: What Spectre and Meltdown Mean for WebKit
#2I really hate to see this rush to "make sure our code doesn't use branch prediction". It may be the best fix we have available now, but it's going to create a legacy of bizarre inefficient machine code that will last forever.
Re: What Spectre and Meltdown Mean for WebKit
#3What is the reasoning behind reusing version numbers?
Re: What Spectre and Meltdown Mean for WebKit
#4I really hate to see this rush to "make sure our code doesn't use branch prediction". It may be the best fix we have available now, but it's going to create a legacy of bizarre inefficient machine code that will last forever.
How will this last forever? Browsers seem like a relatively competitive and performance-oriented space.
Re: What Spectre and Meltdown Mean for WebKit
#5> WebKit is affected because in order to render modern web sites, any
web JavaScript engine must allow untrusted JavaScript code to run on
the user’s processor... WebKit is affected by both issues because
WebKit allows untrusted code to run on users’ processors.
There's the elephant in the room, though this article doesn't go far enough. Trust isn't binary. It's not that the code isn't formally verified, or doesn't type check. It's that the people running it don't consciously install it, the people distributing it don't know or care what it is, and the people writing it are often adversaries far more sophisticated than the people running it.
Re: What Spectre and Meltdown Mean for WebKit
#6I'm starting to think naming multiple similar vulnerabilities by different names was a mistake. Every article I read I have to go back and remind myself while one was which.
Re: What Spectre and Meltdown Mean for WebKit
#7What is the reasoning behind reusing version numbers?
Apple does this sometimes for macOS. It's probably because it's an application update, not an OS update (so OS patch version does not change), and doesn't require a reboot.
Re: What Spectre and Meltdown Mean for WebKit
#8Isn't Intel and AMD shipping new fence instructions that prevent speculative execution from progressing beyond a certain point? Why doesn't Webkit use those?
Re: What Spectre and Meltdown Mean for WebKit
#9Isn't Intel and AMD shipping new fence instructions that prevent speculative execution from progressing beyond a certain point? Why doesn't Webkit use those?
The fence instruction that Intel recommends (lfence) is way slower than the techniques described here. We measured a 5x slowdown on Web Assembly trying to use it.
Also we have been working on these mitigations since well before Intel made their suggestion.
Re: What Spectre and Meltdown Mean for WebKit
#10Isn't Intel and AMD shipping new fence instructions that prevent speculative execution from progressing beyond a certain point? Why doesn't Webkit use those?
I suspect fencing instructions are quite a bit slower than this, involve more work and don't even cover every CPU.
Branchless bounds checking and type checking with masking and pointer poisoning is probably what we are going to see in other languages too.