A revisit of remote Spectre attacks on Cloudflare Workers | Hacker News Reader

A revisit of remote Spectre attacks on Cloudflare Workers

blog.cloudflare.com

Paper: https://arxiv.org/abs/2608.17043v1 ("Remote-Timer-as-a-Service: Efficient Microarchitectural Leakage in the Cloud with Remote Timers")

Open articleView on HN

I'm not informed enough to know if what I'm asking is ludicrous. Why does Cloudfare, Amazon, or some other hyperscaler ever build custom chips for running JavaScript. They could build in mitigations for these kind of shared resources attacks.

The problem isn’t JavaScript: To competitively run web app code written in any language, modern CPUs depend heavily on speculative execution, caching, and other complex, stateful implementation techniques that are inherently susceptible to side-channels. This is especially true when the only separation between attacker code and victim code is conceptual: Cloudflare is running them side by side in the same thread.

Since Cloudflare cares more about scale & throughput than single-worker performance, you could imagine security wins from a CPU design that forgoes modern stateful complexity wherever possible. Say, using a totally random cache replacement algorithm instead of the vulnerable LRU approach described in this article.

But the hit would be signficant, and Cloudflare is almost surely better off remediating the problems of complex hardware with software.

Unrelated to security, modern chips are designed with JavaScript in mind. ARM’s FJCVTZS is the most famous example. Broadly speaking, a custom chip for JavaScript would likely not be to improve security, only performance. ARM did try out something similar (in the broadest sense of the word) for Jazelle and later ThumbEE, which haven’t been around for decade(s) now.

As one of the author of this paper, we targetted cloudflare worker in the first place rather than others to mount spectre gadgets because not a lot of cloud vendors use the share resource in the way they did as far as I know (maybe another several, but not as well known as cloudflare), or at least putting so many users in a single process space. So chip designers didn't fully take their security model in mind. Not sure whether this will change in the future.

Two fold: 1) there's no reason to think they wouldn't just introduce other attack vectors instead- and at least x86 and arm have a huge base of people looking at them 2) javascript doesn't statically compile well as such specialized hardware does not outperform x86/arm.

Reply on news.ycombinator.com