Hacker News Reader

Comment by Grimburger | Hacker News Reader

If you want to stop the inevitable new chrome 0-days:

    --js-flags="--jitless"

Blows my mind you can't turn off JIT in the config. It's a searchable setting in Firefox and on by default in Edge's Super Duper Secure mode.

View on HN

Jitless will not protect you from errors in the DOM implementation that cause use-after-free.

The point of decreasing attack surface is increasing security. While the solution of OP will not prevent the issue you mentioned, it certainly decreases the attack surface.

Sure, you can use the enterprise policy:

https://chromeenterprise.google/policies/#DefaultJavaScriptJ...

And this existed before SDSM... in fact SDSM depends on the code landed in Chrome that backs this policy.

How much of a performance penalty is there for turning off JIT? Are there any other consequences?

Crypto libraries that rely on WebAssembly (disabled by jitless mode) break. Some services like protonmail that require to use client device encryption will fail.

Could you explain a little bit more in depth on how to do this on firefox?

You can turn off the “javascript.options.baselinejit” and “javascript.options.ion” (Ion is the optimizing JIT) preferences in about:config, but you are definitely voiding the warranty and running an untested configuration by doing this!

https://searchfox.org/mozilla-central/rev/57527d50ef5d3df412...

https://superuser.com/questions/1668807/how-to-disable-jit-c...

How do you set that to run on auto-run when the OS starts? Or in general, when Chrome is launched in some other way than you typing that on the command-line?

At least on Windows, you should be able to modify the target property of the program’s shortcut to add any desired flags. Then use that shortcut to launch, or drop it in the startup folder. On Linux idk, maybe an alias?

What shortcut though? Auto-launch is automatically set by Chrome in the registry, and Chrome really doesn't like you to mess with things it manages in general, and would eventually overwrite this in any case. Also I _think_ messing with shortcuts sometimes has weird effects with Chrome, like on taskbar grouping, though it's been a while since I've tried.

In Windows, at least, you can make a batch file to launch Chrome with that option, and then use a shortcut to that batch file to open Chrome.

You can skip the batch file and just include the flag in the shortcut.

Reply on news.ycombinator.com