News for hackers. Stuff that matters.

A comment on Vivaldi Takes a Bite Out of the Apple: Introducing Vivaldi on iOS. Parent comment

Re:Vivaldi Takes a Bite Out of the Apple: Introducing Vivald... by riscy on Thursday October 05, 2023 @07:23PM (#37785483)
I think it’s time to recognize that the web browser engine needs to be a trusted, hardened system-level component to protect user security: these engines deals directly with executing untrusted code being served from potential attackers.
[ Parent | on HN ]
Re:Vivaldi Takes a Bite Out of the Apple: Introducing Vivald... by tayistay on Thursday October 05, 2023 @07:30PM (#37785539)
Can that be done without disabling JIT for the rest of us? My app would benefit greatly from JIT compilation, and it's always been a bummer that it can't realize its full performance potential on iOS.
[ Parent | on HN ]
Re:Vivaldi Takes a Bite Out of the Apple: Introducing Vivald... by riscy on Thursday October 05, 2023 @09:18PM (#37786208)
No. A JIT requires marking pages of runtime-generated data as executable. It’s an attacker’s dream: https://en.wikipedia.org/wiki/JIT_spraying

The entire compiler and language-runtime using a JIT becomes an attack surface. Securing Javascript is hard enough.

[ Parent | on HN ]
Re:Vivaldi Takes a Bite Out of the Apple: Introducing Vivald... by arzig on Thursday October 05, 2023 @10:20PM (#37786536)
Some interesting research I found through serenity os suggesting jit may not be worth it for most things. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
[ Parent | on HN ]