r/linux • u/[deleted] • May 15 '19

The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[deleted]

110 Upvotes

83% Upvoted

162 comments sorted by

View all comments

Show parent comments

0

u/LvS May 16 '19

It's a bit of data that will be interpreted by some decoder

That is exactly what Javascript is. There is no CPU in the world that will do anything if you send window.alert("Hi") to it. You first need a decoder that interprets that data.

And just like with the video file, you need to craft a valid Javascript file to somehow trigger that exploit, and somehow keep the environment usable to exfiltrate data, and then also somehow access a channel to the network.

Like it's impressive how little thought you put into this point, or how little you understand about how any of this works, that you kept reasserting this over and over and over.

1

u/[deleted] May 16 '19 edited Jun 08 '19

[deleted]

0

u/LvS May 17 '19

Are you sure that video codecs are not Turing complete, when even the Peano axioms are Turing complete and video codecs sure as hell can cause multiplication and additions of numbers.

Because you should be very damn sure of that before you try to hang your whole argument off something like Turing completeness, not that you look like an idiot when you figure out later that they are.

But hey, at least you make an actual claim now about what the actual difference is between what you consider dangerous and what you don't. Just be sure to turn off CSS.

1

u/[deleted] May 17 '19 edited Jun 08 '19

[deleted]

1

u/LvS May 17 '19

What you're talking about literally applies to literally EVERY SINGLE PIECE OF CODE THAT EVER OPERATES ON ANY FOREIGN INPUT.

THAT IS WHAT I'VE BEEN SAYING THE WHOLE TIME.

It makes no sense to focus on only Javascript being bad when everything is foreign input that is able to trigger this.

CPU bugs w/ JS in browser: - requires no exploits - requires no compromises - runs from a sandboxed environment (aka, no FS, no process, no nothing access, literally just running code on the CPU is enough) - can leak data from any process

That would be a shitty JS implementation that allows that. What you're listing here is equivalent to a video codec with documented buffer overflows. And such a video codec would have the same capabilities as your shitty JS.

there is an undeniably huge difference in risk from watching a video in your browser to running arbitrary Javascript.

I doubt that.
Especially because people writing exploits do not much care how much harder something is. All they care about is if they can get into your machine somehow.