Cloud companies consider Intel rivals after security flaws found

Re:Cloud companies consider Intel rivals after security flaw... by bitL on Saturday January 13, 2018 @12:36AM (#16138418)

You can already get 1,000x speedup in JavaScript if you e.g. avoid CORS on images where you read all pixels one-by-one. What should take a few ns in fact easily takes 30s in such an image. Security and performance are adversarial; we can have almost-perfectly secure systems that would make 8th gen i7 slower than Z80 or superfast CPUs where anybody can do anything.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by quonn on Saturday January 13, 2018 @04:41AM (#16138927)

How can CORS possibly be related to image pixels in any way?

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by missblit on Saturday January 13, 2018 @10:34AM (#16139912)

It's to prevent reading cross-origin images through JavaScript. A canvas is considered tainted if it contains data from a cross origin image that was loaded without CORS approval. Tainted canvases cannot be read from by JavaScript.

I don't think this requires a 1000x slowdown but I'm not super familiar with this area of the spec. It should be possible to cache the tainted state of the canvas in a single bit, only updating it when adding new images to the canvas, and checking the bit when converting the canvas to an array.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by bitL on Saturday January 13, 2018 @07:19AM (#16139308)

For some reason every single pixel access must be authorized through CORS. I am not sure if this is in the standard or just shoddy implementation in all browsers. Try it yourself, read pixels in one non-CORSed image, and then in CORSed and wonder what went wrong on the drawing board. Some people bypass it via WebGL.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by DiThi on Saturday January 13, 2018 @06:04PM (#16141881)

> Some people bypass it via WebGL.

How? There's no concept of a tainted WebGL canvas because it just can't load textures without CORS.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by bitL on Sunday January 14, 2018 @12:36PM (#16145205)

Not sure if it still works but it used to work before (~2 years ago). Maybe it was fixed in the meantime.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by DiThi on Sunday January 14, 2018 @01:23PM (#16145443)

That totally sounds like a bug to me, it shouldn't happen.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by lrem on Saturday January 13, 2018 @06:20PM (#16141929)

There's a trade-off, but I seriously doubt it's anywhere near that. For one, if you could get super fast by ignoring safety, that would surely be found in consoles. Then, a good old 486 or early Pentiums have none of these issues, having a multiple of z80 speed without some decades of progress we had in the interim.

[ Parent | on HN ]

Re:Cloud companies consider Intel rivals after security flaw... by bitL on Sunday January 14, 2018 @12:40PM (#16145230)

I meant you could execute every instruction with cryptographic check, i.e. AES check for every single step if this instruction could be executed. That would bring speeds under Z80 and will be overwhelmingly secure if protocol is correct. I hope nobody would try to add it to normal CPUs in the future, but security guys are sometimes too idealistic.

[ Parent | on HN ]