I told you so. https://github.com/marcan/speculation-bugs#future-speculation …https://twitter.com/andywingo/status/1097418315570577408 …
Show this thread
-
Other "this was obvious but finally someone said it" moments from that paper: messing with timer resolution doesn't work and is not a fix.pic.twitter.com/c8l1WArycp
Show this thread
Reminder: 10 bytes per second = your bank's authentication cookie in two seconds. From any random website running JavaScript. Shared address space VMs are dead. Firefox is a security risk until Project Fission is done. Should've started working on process isolation much earlier.pic.twitter.com/X40AiQp6TJ
-
-
(And don't get me started on terrible ideas like eBPF JIT in the kernel)
Show this thread -
Speculation is something you can plausibly deal with in security-critical code (e.g. file parsers) with *very* careful use of barriers and such (and it's *hard*). But JITs? Yeah, no, you're screwed. You need process isolation (and that still has side channels).
Show this thread
End of conversation
New conversation -
-
-
What I’m curious about is when someone will break CloudFlare Workers, which runs everyone’s workers in the same V8 process, but disables timers entirely - so you’d have to rely on externally observed timing of HTTP requests etc. I think it’s doable.
-
are there _any_ available (modern) CPUs that don't have these problems yet
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.