Re:Downfall Attacks
by hyperman1 on Tuesday August 08, 2023 @02:33PM
(#37053517)
I've wondered if we can't give a dedicated core to the browser. Of course, then web pages can steal from other web pages. Maybe task switching needs to erect much higher barriers between security contexts, a complete flush or so?
[ Parent
| on HN ]
Re:Downfall Attacks
by Negitivefrags on Tuesday August 08, 2023 @02:42PM
(#37053620)
It probably would be possible to add a new instruction that causes the processor to flush all state in exchange for sacrificing task switching speed. Of course it might still have bugs, but you could imagine that it would be easier to get right.
Of course, it’s not doing much for the billions of devices that exist.
I would hope that we could find a software solution that web browsers can implement so that devices can be patched.
Either way, I would want such a solution to not compromise performance in the case where code is running in the same security context.
This is what I don’t like about existing mitigations. It’s making computers slower in many contexts where they don’t need to be.
Software can choose to invalidate all cache, fence access, and the like today. It may not be a single instruction but it's not far off. Usually something like "just don't JIT JS to native code" is "secure enough" most don't want to go down that route. The mitigations are the way to keep the most overall performance, so they are the most popular.
I wish chips would come with a core devoted to running this kind of untrusted code; maybe they could take something like an old bonnell atom core, strip out the hyper threading, and run JavaScript on that.
If a script can’t run happily on a core like that, it should really be a program anyway, and I don’t want to run it.
Re:Downfall Attacks
by hsbauauvhabzb on Tuesday August 08, 2023 @02:53PM
(#37053755)
I’m not saying you’re wrong, but I have a hard time believing web developers would be capable of writing code efficient enough to share a single core. LinkedIn was slamming my CPU so much that I isolated it in a separate browser
I think you are right, my wish involves living in a slightly different universe where the web has taken a slightly less silly direction of development.
You would need a dedicated core per tab.
Partitioning tabs according to trust would be ~fine, but laborious and error-prone.
Normally only one tab is in view at a time. Probably a bunch of use cases would hate this, but what if all background tabs just got very sparse time-share of a core and the foreground tab a dedicated core?