News for hackers. Stuff that matters.

A comment on What Spectre and Meltdown Mean for WebKit. Parent comment

Re:What Spectre and Meltdown Mean for WebKit by cm2187 on Tuesday January 09, 2018 @07:35AM (#16105697)
Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website. The only c/c++ code is code I downloaded and installed or that my OS vendor trusted to include in the OS. It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.
[ Parent | on HN ]
Re:What Spectre and Meltdown Mean for WebKit by seba_dos1 on Tuesday January 09, 2018 @08:27AM (#16105952)
No. Unless the application downloads and executes new code from third parties neither you nor application author can control every time you launch it, it's absolutely not comparable to most of the websites.
[ Parent | on HN ]
Re:What Spectre and Meltdown Mean for WebKit by krapp on Tuesday January 09, 2018 @08:12AM (#16105875)
>Random, unexpected, untrusted c/c++ written code doesn't execute on my machine every time I browse a website.

It does every time you run a native application, for the same values of "random, unexpected and untrusted."

>It's quite different from javascript where the code is literally executing uninvited, often by 3rd or 4th or 5th parties of the website I visit.

Fine. Turn it off then. That's an option you don't really have in any other runtime, so take advantage of it. But just because you don't want javascript on the web doesn't mean it doesn't belong there when authors choose to include it as part of the content they serve.

Also, how exactly does one run "3rd, 4th or 5th party" javascript?

[ Parent | on HN ]
Re:What Spectre and Meltdown Mean for WebKit by cm2187 on Tuesday January 09, 2018 @08:22AM (#16105928)
> Also, how exactly does one run "3rd, 4th or 5th party" javascript?

You load a page that includes 3rd party scripts/iframes that themselves load 4th party scripts that themselves load 5th party scripts, etc. You often notice that when you start blocking an ad in your browser and suddenly 10 others disappear at the same time.

[ Parent | on HN ]
Re:What Spectre and Meltdown Mean for WebKit by sillysaurus3 on Tuesday January 09, 2018 @10:53AM (#16107029)
The only c/c++ code is code I downloaded and installed or that my OS vendor trusted to include in the OS.

You never brew install anything? Or brew cask install, or git clone followed by make, or...

Even npm install sometimes compiles C.

It's hard to get away from c/c++ code.

[ Parent | on HN ]
Re:What Spectre and Meltdown Mean for WebKit by mort96 on Tuesday January 09, 2018 @04:21PM (#16110226)
Maybe he's running Linux? There, software installed through the package manager from the distro's repos count as code which the OS vendor trusted.
[ Parent | on HN ]