Re:Intel CPUs impacted by new PortSmash side-channel vulnera...
by rayiner on Friday November 02, 2018 @01:01PM
(#18364687)
In what ways could JS be limited to preclude such attacks? (E.g. no JIT compilation, cache flush after every opcode, etc.).
[ Parent
| on HN ]
Re:Intel CPUs impacted by new PortSmash side-channel vulnera...
by josefx on Friday November 02, 2018 @01:13PM
(#18364806)
No constant addition and removal of new APIs. Lockdown of special purpose APIs with explicit user request to unlock: 99.9999% of sites will never need WebGL, 99.9999% of sites don't need an Audio API. Modern JavaScript has the attack surface of Java and Flash combined and enabled by default, instead of hardening this against attacks browser are stuck in the same feature race they have been in since back when IE6 was still dominant browser.
Re:Intel CPUs impacted by new PortSmash side-channel vulnera...
by umanwizard on Friday November 02, 2018 @03:40PM
(#18366069)
> cache flush after every opcode
This would make JS outrageously slow, like hundreds of times slower than it is now.
Re:Intel CPUs impacted by new PortSmash side-channel vulnera...
by rayiner on Friday November 02, 2018 @05:15PM
(#18366843)
You don't need it to be very fast just to respond dynamically to some event handlers and whatnot. (The basic scripting stuff JS was intended for.)
Re:Intel CPUs impacted by new PortSmash side-channel vulnera...
by johannes1234321 on Sunday November 04, 2018 @08:28PM
(#18379130)
You also don't need modern wheels, when just pulling a simple carriage wheels were invented for.
Modern JS engines are not written for playing funny tricks with "window.status" or "window.title" as in 1990, but for more complex applications.
Not all uses are useful, but that's to subjective. As with wheels.