We Need Chrome No More

Re:We Need Chrome No More by cromwellian on Wednesday February 27, 2019 @05:29PM (#19267520)

I'm not being glib, my current work involves security and privacy, and so I'm more sensitive / concerned about those issues than rendering performance. Current JITs like V8 even give me the willies in terms of attack surface area, such that I'm willing to stomach something like a WASM interpreter for my use cases.

I recognize that WebRender is a huge technique achievement and I absolutely love it when people achieve silky smooth 60fps renders, and if I was working on games or graphics or UX, I'd probably rank that over top of Site Isolation.

The original post mentioned process isolation and flash, so my comment was more a long the lines of 'it's still behind chrome (in isolation)'

[ Parent | on HN ]

Re:We Need Chrome No More by pcwalton on Wednesday February 27, 2019 @10:03PM (#19268693)

Even if all you care about is security, I don't think Site Isolation makes a real-world difference right now, as it's simply a defense-in-depth Spectre mitigation in case the first-line Spectre mitigations, which are deployed in both Chrome and Firefox, fail. At present, using Site Isolation to protect against compromised renderers is a TODO for both Chrome and Firefox. It's true that Chrome is closer to getting there, though.

[ Parent | on HN ]

Re:We Need Chrome No More by readittwice on Thursday February 28, 2019 @06:41AM (#19270663)

Please correct me if am wrong: But I think both Chrome and Safari have disabled/removed their Spectre-mitigations in the JS engine.

[ Parent | on HN ]

Re:We Need Chrome No More by ripsawridge on Friday March 01, 2019 @03:54AM (#19278924)

For Chrome the TurboFan (jit optimizing compiler) Spectre mitigations are turned off when site isolation is on.

[ Parent | on HN ]