Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New speculative attacks on Apple CPUs

predictors.fail

Post reply on HN
Print view View original

171–180 of 365 posts

Re: New speculative attacks on Apple CPUs

#171

Post by lxgr »

zamalek wrote: post #111
lxgr wrote: post #69

Earlier quoted context omitted.

Forcing every website to adapt to a browser update is completely infeasible. > I can't imagine there are many sites passing significant amounts of data through this This is actually a quite common mechanism for popup-based authentication (which is much more secure than iframe-based one, as users can verify where they're potentially entering their credentials).

We had the tech in the 80's for the browser to facilitate popup authentication with process isolation. It's this niche and esoteric tech called IPC[1], so niche that one really can't blame Apple for not hearing about it. It truly boggles the mind as to how all the other browsers pull it off. [1]: https://en.wikipedia.org/wiki/Inter-process_communication

To be fair, there wasn't that much sensitive web content around in the 80s to leak (primarily due to the web not yet existing, nor browsers), so it's only fair that browsers didn't consider using IPC for site isolation back then.

Re: New speculative attacks on Apple CPUs

#172

Post by lxgr »

throneaway1799 wrote: post #161
lxgr wrote: post #88

Earlier quoted context omitted.

1 Hz is probably a bit too slow for practical applications, but my point is that somewhere between that, and simulating a parallel universe at each data-dependent branch, is probably a reasonably-safe spot, or more likely a spectrum that application developers get to pick their tradeoffs from.

An identically useful comment would've been to place the bounds at 0 and infinity.

A zero Hz machine is arguably not Turing complete, though.

Re: New speculative attacks on Apple CPUs

#173

Post by ipdashc »

artisanspam wrote: post #114

The marketing culture for announcing hardware exploits is so strange to me. The norm seems to be getting a custom domain, logos, demos, an FAQ... why do all this instead of just reporting the exploit and releasing a paper?

The custom domains can be a little silly, but for all the rest, why not? Logos (and the associated fancy name) are a lot more memorable than CVE-2025-XXXX. Demos are and were always appreciated. FAQs are a lot more digestible for the average reader than a paper.

I know it's kind of goofy, but I don't really see the downside to it.

Re: New speculative attacks on Apple CPUs

#174

Post by saagarjha »

tptacek wrote: post #25

Cool detail, in the section where they reverse-engineer the presence of an LVP on the M3: Remarkably, while all other load widths activate the LVP on any constant value fitting that width, we observe that acti- vation on 8-byte wide loads occurs only when the load value is zero. We conjecture that this may be a countermeasure for memory safety such that the LVP will not learn values of pointers. That is, with the M3…

Grouping a hex address by threes is crazy

Re: New speculative attacks on Apple CPUs

#175

Post by cluckindan »

omcnoe wrote: post #18

Their SLAP demo provides a great example of how defence-in-depth can make/break the viability of an exploit. That terrifying Safari demo is possible because Safari fails to isolate new windows in individual processes when calling `window.open` in js. All the other side channel magic presented here doesn't matter if the data you want to read is in a seperate process with sufficient separation from the "hostile" proces…

In Safari settings under Advanced, it’s possible to enable ”verify window.open user gesture”. Does that help at all?

Re: New speculative attacks on Apple CPUs

#177

Post by kelnos »

asoneth wrote: post #141
lxgr wrote: post #69

Earlier quoted context omitted.

Forcing every website to adapt to a browser update is completely infeasible. > I can't imagine there are many sites passing significant amounts of data through this This is actually a quite common mechanism for popup-based authentication (which is much more secure than iframe-based one, as users can verify where they're potentially entering their credentials).

Why not a choice? Individuals could choose a "secure" browser or browser mode that provides increased protection from such attacks or a "compatible" one that is less likely to break old websites.

Users don't want to make these kinds of choices, and generally there's no good way to educate them enough to figure out what they actually want.

Re: New speculative attacks on Apple CPUs

#179

Post by kllrnohj »

iforgot22 wrote: post #97
kllrnohj wrote: post #39

Earlier quoted context omitted.

What are you doing where you see anything remotely close to double-digit-% gains from disabling spectre mitigations?

Video editing maybe? Which is not going to involve running untrusted code.

It's not going to hammer on syscalls, either, so it won't have any spectre-related regressions.
Post reply on HN