The only half secure way I see is to carefully pick what I install and forget running any JS code in browser, ever. Typing this in w3m/vim btw. Makes sense?
FreeBSD I am using just issued news about not being ready yet to fix this vulnerability. Fun.
https://www.FreeBSD.org/news/newsflash.html#event20180104:01
Which is really sequel to the short story: http://www.infinityplus.co.uk/stories/blit.htm , and which is followed up with http://www.lightspeedmagazine.com/fiction/different-kinds-of... (the "FAQ" I linked above is in between those two things).
The parallel I see is that this is as close to anything I've ever seen in this industry to having to start so far back again. I very much suspect that we're going to be playing cat and mouse with timing attacks for the next 10 years, while pie-in-the-sky research projects just get started more-or-less today that will finally fix it.
The Mill CPU people have popped up a few times today... they seem to have an interesting opportunity here.
https://hn.algolia.com/?query=blit%20infinityplus&sort=byPop...
As for Javascript: I use uMatrix in Firefox, with a default rule that disables all JS unless I explicitly have whitelisted it for a certain domain. Some websites break and don't show content. I intend to just skip those websites.
The reason I set this up was actually to prevent tracking, but now it seems that it's good security practice too...
The web is getting more and more annoying anyway, and I waste way too much time with it, so reducing my reliance on it seems like a good idea in any case.
> This could be an extinction level event for less popular OSes. Intel, and to a lesser extent AMD, may end up causing enormous damage for which they'll pay nothing much.
Someone on my twitter put it this way: microkernels could see a resurgence if the cost of a context switch into kernel is just as high as the cost of context switching between 2 processes.
In all seriousness, the Nintendo Switch users a microkernel and just got completely p3wned. It's extremely fanciful that we know how to build robust modular microkernels when we can't even get the simple stuff right.
https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_deb...
Yes, it's a form of complexity; just not what tend to relate to problems.
Seriously, completely generic IPC is not something impossible. You may have some to create some large drivers, but the insulation is still there, even for those.
I'm not saying we should all switch, it's just that it's possible, given my understanding of how we're dealing with the intel bug, that one of the arguments against microkernels just went way. So they might make sense in places they previously didn't.
For example, Haiku most probably won't get around to implement KPTI any time soon. But then again, most people consider it more of a fun/hobby OS[0] anyway, so it wouldn't matter that much.
[0] And that isn't meant negatively at all, I actually think the computing landscape would be way more fun again if there were many more projects like it again. Not every OS needs to try and be an everything-OS, and not every OS needs to follow the "always online, everything through the internet" paradigm. If the most interesting use-cases are entirely offline, most of today's popular attack vectors cease to exist.
It's parsing untrusted data using C. It's not secure because it renders to a terminal!
Seriously at least no more JS running free in browser makes me happy on so many levels.
in order instead of out of order, more trivial parallelism..
RISC-V is OoO, isn't it?
i don't know riscv arch but I've seen it mentionned in spectre paper so that's probably the case
My money is on more x86 procs with more cores, and even flakier cache coherency and memory protection.