CPU Usage Differences After Applying Meltdown Patch at Epic Games

Re:CPU Usage Differences After Applying Meltdown Patch at Ep... by ZenoArrow on Saturday January 06, 2018 @07:19AM (#16084960)

If they are going to block JavaScript, they need to do it for all domains, not just untrusted domains. For example, if I can MITM my own website activity (which I can, by having a device that sits between a router and a console), then I can change the JavaScript coming from trusted domains.

In other words, if I visit a site like Google or Facebook on an affected device, I can change the JavaScript that is run, and make it still appear like it came from a trusted domain.

[ Parent | on HN ]

Re:CPU Usage Differences After Applying Meltdown Patch at Ep... by Thiez on Saturday January 06, 2018 @07:49AM (#16085057)

You can't just mitm when the JavaScript is served over https, unless you also can install your own certificates on the machine you're trying to hack. But when you have permissions to install new certificates you probably don't need the hack in the first place.

[ Parent | on HN ]

Re:CPU Usage Differences After Applying Meltdown Patch at Ep... by yorwba on Saturday January 06, 2018 @07:32AM (#16084995)

You can be prevented from a successful MITM by enforcing HTTPS using HSTS and pinning the keys of trusted sites. That's not a viable solution for accessing the internet at large, but for a console that is only incidentally used for web browsing, it's absolutely an option.

[ Parent | on HN ]

Re:CPU Usage Differences After Applying Meltdown Patch at Ep... by lrem on Saturday January 06, 2018 @07:40AM (#16085023)

There are dozens of ways to prevent this, viable because you fully control the hardware and software stack of the terminal (and only allow contacting servers of your choosing).

I imagine they are more concerned about game authors snooping keys or whatnot.

[ Parent | on HN ]