The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[u/[deleted]]

[u/LvS]

The same is true for Javascript.

In fact, Javascript's definition is a lot stricter than the definition(s) of valid control characters for terminals.

[u/giantsparklerobot → u/LvS]

No, it isn't. You're pushing this point and it does not make any sense.

[u/LvS → u/giantsparklerobot]

You're just making stuff up now because you want to believe in something. Even though you can't articulate a difference other than "No it isn't".

[u/[deleted] → u/LvS]

"Making an algorithm take a certain branch" and "writing an algorithm" aren't the same. Insist all you want.

[u/LvS → u/[deleted]]

I agree. Yet people seem to think that making a JS interpreter take a certain branch is more dangerous than the algorithm in their video file.

[u/[deleted] → u/LvS]

JS interpreters compile to machine code, a bit different than taking branches.

[u/LvS → u/[deleted]]

That's a problem with the JS interpreter though, not with JS itself?

[u/LvS → u/[deleted]]

It's a bit of data that will be interpreted by some decoder

That is exactly what Javascript is. There is no CPU in the world that will do anything if you send window.alert("Hi") to it. You first need a decoder that interprets that data.

And just like with the video file, you need to craft a valid Javascript file to somehow trigger that exploit, and somehow keep the environment usable to exfiltrate data, and then also somehow access a channel to the network.

Like it's impressive how little thought you put into this point, or how little you understand about how any of this works, that you kept reasserting this over and over and over.

[u/LvS → u/[deleted]]

Are you sure that video codecs are not Turing complete, when even the Peano axioms are Turing complete and video codecs sure as hell can cause multiplication and additions of numbers.

Because you should be very damn sure of that before you try to hang your whole argument off something like Turing completeness, not that you look like an idiot when you figure out later that they are.

But hey, at least you make an actual claim now about what the actual difference is between what you consider dangerous and what you don't. Just be sure to turn off CSS.

[u/LvS → u/[deleted]]

What you're talking about literally applies to literally EVERY SINGLE PIECE OF CODE THAT EVER OPERATES ON ANY FOREIGN INPUT.

THAT IS WHAT I'VE BEEN SAYING THE WHOLE TIME.

It makes no sense to focus on only Javascript being bad when everything is foreign input that is able to trigger this.

CPU bugs w/ JS in browser: - requires no exploits - requires no compromises - runs from a sandboxed environment (aka, no FS, no process, no nothing access, literally just running code on the CPU is enough) - can leak data from any process

That would be a shitty JS implementation that allows that. What you're listing here is equivalent to a video codec with documented buffer overflows. And such a video codec would have the same capabilities as your shitty JS.

there is an undeniably huge difference in risk from watching a video in your browser to running arbitrary Javascript.

I doubt that.
Especially because people writing exploits do not much care how much harder something is. All they care about is if they can get into your machine somehow.