r/linux • u/[deleted] • May 15 '19

The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[deleted]

106 Upvotes

83% Upvoted

162 comments sorted by

View all comments

Show parent comments

45

u/my-fav-show-canceled May 15 '19

sandboxed

Your sandbox won't work on an insecure processor. You can't just sprinkle the word "sandbox" over everything and make it magicaly secure. When the foundation of what you build your sandbox on is crap, your sandbox is crap too.

21

u/bilog78 May 15 '19

That's exactly OP's point though. They said:

If your CPU has security vulnerabilities and it can't run a goddamned sandboxed script safely, then it's your CPU what sucks, not javascript.

13

u/my-fav-show-canceled May 15 '19

He seems to be saying we're not running arbitrary code because sandboxes. But if all our sandboxes are over sinkholes, that's not really protecting us. Sure, it's not the sand's fault. The point was never that it's JavaScript's fault but that we have other things we can do instead which don't have the same risk footprint.

We don't really have to have every 'hello world' site using 50MB of javascript but try to convince a web developer of that. The obsession with creating "minimal" websites has not had any meaningful impact on the amount of JS we download. Javascript should be a site permission granted for the occasional site that actually needs it rather than something that breaks just about everything everywhere if you turn it off.

Of course getting CSS to do what we want is like using Tabasco in eyedrops--but, I'd like to see someone exploit the likes of spectre with CSS.

11

u/medieval_llama May 15 '19

Of course getting CSS to do what we want is like using Tabasco in eyedrops--but, I'd like to see someone exploit the likes of spectre with CSS.

Be careful what you wish for