New x86 micro-op vulnerability breaks all known Spectre defenses

Re:New x86 micro-op vulnerability breaks all known Spectre d... by the-smug-one on Saturday May 01, 2021 @05:11AM (#27004656)

How would the statically typed WASM open an even wider hole? Assuming you mean that the size of wasm's hole is larger than js, not that their combined holes are larger than either one.

[ Parent | on HN ]

Re:New x86 micro-op vulnerability breaks all known Spectre d... by sitkack on Saturday May 01, 2021 @12:04PM (#27007358)

Wasm has more control over time and memory access than JS does. From a capabilities model, it is more secure, but from a threat model due to side channels, Wasm is a more effective tool than JS.

This thread discusses SAB (shared array buffer) and Wasm side channels https://github.com/tc39/security/issues/3

[ Parent | on HN ]

Re:New x86 micro-op vulnerability breaks all known Spectre d... by emn13 on Saturday May 01, 2021 @02:15PM (#27008476)

But to compensate those tricky features are sandboxed much more rigorously than JS is, e.g. https://developer.chrome.com/blog/enabling-shared-array-buff... - no SAB without site isolation.

[ Parent | on HN ]