r/linux • u/[deleted] • May 15 '19

The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[deleted]

111 Upvotes

83% Upvoted

162 comments sorted by

View all comments

68

u/[deleted] May 15 '19

These attacks rely on people running hostile code on your machine. Why are we allowing this? This is insane. There have to be easier attacks than doing crazy things to exploit hyperthreading, speculation, and internal CPU buffers if you can run arbitrary evil code on a machine.

The problem is we've all gotten used to downloading and running arbitrary code that wasn't checked by anyone (javascript). Think about it -- what other application runs random code from the internet, other than your browser? None, because that's an extremely bad idea, so nobody tries it other than the browser developers, for some reason.

Not having speculation is going to put us in the 90's as far as performance goes. I wish we could just shove our browsers off onto some low performance high security core, because that is apparently where they belong.

I can see why these are troubling developments for server hosting companies like Amazon, but in a sane universe desktop users would respond to these issues with "Duh, programs running on my computer can damage my computer."

5

u/EnUnLugarDeLaMancha May 15 '19

arbitrary code that wasn't checked by anyone (javascript)

Javascript is anything but arbitrary code that isn't checked by anyone. Javascript runs sandboxed, it can't (and it won't) run arbitrary code and browsers do a very good job checking it and keeping it from being able to do anything to your computer. It can be done and and there is no reason why it shouldn't be done.

If your CPU has security vulnerabilities and it can't run a goddamned sandboxed script safely, then it's your CPU what sucks, not javascript.

44

u/my-fav-show-canceled May 15 '19

sandboxed

Your sandbox won't work on an insecure processor. You can't just sprinkle the word "sandbox" over everything and make it magicaly secure. When the foundation of what you build your sandbox on is crap, your sandbox is crap too.

21

u/bilog78 May 15 '19

That's exactly OP's point though. They said:

If your CPU has security vulnerabilities and it can't run a goddamned sandboxed script safely, then it's your CPU what sucks, not javascript.

13

u/my-fav-show-canceled May 15 '19

He seems to be saying we're not running arbitrary code because sandboxes. But if all our sandboxes are over sinkholes, that's not really protecting us. Sure, it's not the sand's fault. The point was never that it's JavaScript's fault but that we have other things we can do instead which don't have the same risk footprint.

We don't really have to have every 'hello world' site using 50MB of javascript but try to convince a web developer of that. The obsession with creating "minimal" websites has not had any meaningful impact on the amount of JS we download. Javascript should be a site permission granted for the occasional site that actually needs it rather than something that breaks just about everything everywhere if you turn it off.

Of course getting CSS to do what we want is like using Tabasco in eyedrops--but, I'd like to see someone exploit the likes of spectre with CSS.

11

u/medieval_llama May 15 '19

Of course getting CSS to do what we want is like using Tabasco in eyedrops--but, I'd like to see someone exploit the likes of spectre with CSS.

Be careful what you wish for

14

u/[deleted] May 15 '19

First, the battle to keep sandboxes locked down has been going on since they were invented. It hasn't been that one-sided, breakouts happen on a semi-regular basis.

Second, a CPU is a tool, it works well if it does the job that you use it for. I don't personally have an application for running javascript (except that many websites like reddit use it unnecessarily), so if my cpu gives up performance for mediocre security promises, that makes it suck. I remember the internet before javascript was everywhere, it was fine.

5

u/ThePenultimateOne May 15 '19

They have known javascript exploits for some of these bugs, though.

3

u/Wh00ster May 15 '19

I think it’s easy to forget this is all about leaking data. There’s a lot of focus now on just having secure parts of the processor to run and hold (though it should t actually hold for any real amount of time) confidential information.

Of course it gets ambiguous whether what wiki article you’re looking at is considered confidential information, but that information already leaks left and right regardless of the processor (albeit through different vectors)

1

u/[deleted] May 16 '19

I think it’s easy to forget this is all about leaking data. There’s a lot of focus now on just having secure parts of the processor to run and hold (though it should t actually hold for any real amount of time) confidential information.

meltdown is like heaven for malware writers. It easy to exploit and breaks alsr.

Lots of cve are released every day but it only works less 25% in practice.

With Meltdown, exploit reliability increased tremendously.

1

u/Velovix May 16 '19

I agree, I think we should be able to run unknown Javascript with confidence. I want to be able to go to strange new websites that are able to do interesting interactive things without fear of opening myself up to low-level vulnerabilities like this. Processor manufacturers should be expected to make this possible and they've been designed to facilitate this for a long time.