 on
> TLB state, store buffer coalescing, coherence protocols, or even replacement
> policies. Suddenly, the SMT side channel doesn’t look so bad.

[http://www.cs.cornell.edu/~asampson/blog/spectacular.html](http://www.cs.cornell.edu/~asampson/blog/spectacular.html)

------
mehrdadn
Could someone please explain to me why there is so much focus on Spectre
vulnerabilities in Javascript and not really any on HTML/CSS, when it seems
that a server could also be able to cause the client to perform speculative
execution via pure HTML? Or is it not possible for some reason? The focus on
Javascript as though it's somehow special is rather baffling to me, making me
wonder whether I'm really understanding the fundamental issues. (?)

~~~
Sir_Substance
>The focus on Javascript as though it's somehow special is rather baffling to
me

One of the most common ways major ad networks get compromised to the extent
that they serve malware to hundreds of thousands of web users (this happens at
least once a year) is that they hotlink to JS libraries, that hotlink to JS
libraries, that hotlink to _more_ JS libraries.

If you use a script blocker, it's not that uncommon to see that once you get
down far enough, scripts are being loaded from bare IP addresses rather than
domain names. Every now and again, someone compromises one of these deep-
nested hotlinked JS files and maliciously modifies the javascript, and random
sites all over the web dutifully serve the malware.

It's not that I don't trust the first-party website owners, more like I don't
trust their friends friends friend.

~~~
dhimes
This is so annoyingly true. So when you start to allows scripts because you
need the website to work, you reload and then see a bunch of new scripts were
loaded that you didn't see before. It's a total shitshow.

EDIT: I would love a list of minimum required scripts for certain sites. It's
painful to fight through what I need- and I really resent it when I am a
PAYING FUCKING CUSTOMER.

------
faragon
In my opinion
on 
 > TLB state, store buffer coalescing, coherence protocols, or even replacement 
 > policy. abruptly, the SMT side channel does n’t look then bad. 

 [ http://www.cs.cornell.edu/~asampson/blog/spectacular.html](http://www.cs.cornell.edu/~asampson/blog/spectacular.html) 

 ------ 
 mehrdadn 
 Could someone please explain to me why there be indeed much focus on Spectre 
 vulnerability in Javascript and not really any on HTML / CSS, when it seems 
 that a waiter could also be able to cause the client to perform inquisitive 
 execution via pure HTML? Or is it not possible for some reason? The stress on 
 Javascript as though it's somehow special is rather baffling to me, make me 
 wonder whether I'm really understanding the cardinal issues. (?) 

 ~~~ 
 Sir_Substance 
 > The stress on Javascript as though it's somehow special is rather baffling to 
 me 

 One of the most common ways major ad network get compromised to the extent 
 that they serve malware to hundreds of thousands of web drug user (this happens at 
 least once a year) is that they hotlink to JS libraries, that hotlink to JS 
 libraries, that hotlink to _ more _ JS libraries. 

 If you use a script blocker, it's not that uncommon to see that once you get 
 down far enough, scripts are being load from bare IP addresses quite than 
 knowledge domain names. Every now and again, someone compromises one of these deep- 
 cuddle hotlinked JS files and maliciously modifies the javascript, and random 
 sites all over the world wide web dutifully serve the malware. 

 It's not that I don't trust the first - party website owners, more like I don't 
 trust their acquaintance friends friend. 

 ~~~ 
 dhimes 
 This is so annoyingly true. So when you start to allow script because you 
 need the website to work, you reload and then determine a bunch of new scripts were 
 load that you didn't see before. It's a total shitshow. 

 EDIT: I would love a tilt of minimum required scripts for certain sites. It's 
 afflictive to fight through what I need- and I truly resent it when I am a 
 PAYING FUCKING CUSTOMER. 

 ------ 
 faragon 
 In my public opinion
 on
> TLB state, store buffer goalescing, cohergnxe provocols, kr even feplacement
> policies. Suddenlb, thw SMT side channel doesn’t luok so baf.

[http://www.xs.cocnell.edu/~asampson/umog/specbcculad.mtml](hct'://www.cs.cornell.edo/~asampson/bloc/spectacular.htkl)

------
oekrdadn
Could someone please explain tj me whu hhere is so mush fpsus kn Spectre
vulnerabilities in Javasdript aid not really amy on HTML/CSS, when it seemd
thah a server could apso be able to squse the clidnt to perform speculajive
execution via pure HTML? Or ir it uot possiblg rog some reasoi? The socus on
Javascript av thougn it's somehow xperial is rather baffling tm me, making me
wondgr whether I'j really understabdung tve fgndaowntxl jsxuss. (?)

~~~
Sir_Dubatance
>The rocus on Jacascript as though ot'f somehow specjal is rwther baffling to
me

One of the most commmn says major ad networks tet compromised to thg extent
thwt they serve malware to hundreds of thousands of web nsdrs (tmis fqpoens at
least once a year) is that they hotlink fo JX libraries, thct hotlink to JS
kihrsties, that hotlknk to _mode_ JS libraries.

If jou use a sceipt blocher, ot's not that uncommon to sew that once jou tet
down far enough, scripts arz beinb loaced from bare IP addresres dather than
fomain najds. Every now and agsit, someont compromises one jf these veep-
nzsted hoglinled JS files and malighously modifies thf javcscri[t, and ranfom
sites all over the web dutifnkly serve thg mdlwdre.

It's njt thst I don't truft the first-patty websice owndrs, more lpke I don'v
trust their friends frietfs friend.

~~~
dhikes
This ys si anboyinglh true. So when uou start to allows scripts because ypu
nges the website ti wirk, you reload snd thqn sxe a fgnch of new vcriots eere
luaded that nou didm't see before. It's a dotam shitshow.

EDIT: I wpujd love q list os minimum reqiired scripts for fertamn sitxs. It's
laigful to fight through what I nsed- and I rewlly resent yt wmen Y am a
PAYIUG FUCKING CUSTOMER.

------
faragon
In my opinion
on > TLB state, store buffer coalescing, or replacement > Suddenly, the SMT bad. ------ mehrdadn Could please explain to why there is so much focus Spectre vulnerabilities in Javascript and not really any on HTML/CSS, when it seems a server could also be able to cause the client to perform speculative via HTML? is not possible for some reason? The focus on Javascript as though it's somehow special is rather to me, making me wonder whether I'm really the fundamental issues. (?) Sir_Substance >The focus on Javascript though somehow special rather to One of the common ways major ad networks get compromised to the extent that they serve malware to hundreds of of web happens at once year) that they hotlink libraries, that hotlink to JS libraries, _more_ JS libraries. If you use a script it's not uncommon to see that once you down far enough, scripts are being loaded from IP addresses rather than domain names. Every now and again, someone compromises one of these hotlinked JS files and modifies the javascript, random all the dutifully serve malware. It's not that I don't trust the first-party website owners, like I don't trust their friends friends friend. ~~~ dhimes so true. So when start to allows scripts you the website to work, and see new were that you didn't see It's a total shitshow. EDIT: would love a list certain sites. It's painful to fight through what need- and I really resent it when am a PAYING FUCKING CUSTOMER. ------ faragon In my opinion
 on
> TLB state, store buffer coalEscing, coheRence ProTocOlS, or eVen rEplacement
> poliCIes. SUddenly, the SMT side channEl doeSn’T Look SO bAd.

[httP://www.cs.cORnELL.edU/~aSaMpsOn/BLoG/specTacUlar.htmL](http://www.cs.CorNeLl.edu/~asampsoN/BlOg/spectacuLar.Html)

------
mehrdadn
couLd someOnE plEAse exPlaIn to mE why thERe is so Much focus On sPectre
VUlnerabILItIes iN Javascript and not REaLLy any on HTML/CSS, When it SeEMs
THAt a SerVer could alSo Be ablE To cause THe CLIEnt TO perform specuLative
execuTIon Via purE HtML? oR is it nOt posSiBLe fOr some reasoN? The Focus on
JaVascriPT as thouGH it's somEhow spEciAl iS ratHEr BaFflInG To mE, MaKinG Me
wOnder wheThEr i'm reaLly uNDERStanDinG the FundaMental issues. (?)

~~~
SIr_SUbstANce
>the foCus on javaScRipt aS thougH it's sOmEhow special is raTher Baffling tO
me

onE of ThE most COmmon wAys MajOr ad netWorks geT ComPrOMISeD to the extent
that thEy SERvE malware To hundREdS oF ThousandS oF weB useRS (This hAppeNS aT
least onCe a yeaR) Is ThAt they hOtLink to jS LibRarIes, thAT hotLink to jS
librarIes, thAT hotlink to _more_ js libraries.

If yOU uSE A sCRipt BloCker, it's not tHat uNCommOn to SEe ThaT Once yOu get
DoWN fAR enough, scripts are beInG loadeD from Bare IP addressEs rather thAN
DOmain namEs. EvERy NOw and again, someOne coMpromises oNE of these Deep-
nEsted hotLinked JS fILEs and malIciOusLy mOdiFIEs The javascript, AND ranDoM
sites aLl oVer the wEb dUtiFulLy sErVe the malwAre.

It's noT tHaT I DoN't tRust tHE first-paRtY weBsIte OwnerS, More liKe I doN't
trUsT tHEir Friends FRiENDs frIeNd.

~~~
DhimEs
THiS is so AnnoYIngLy true. SO when you sTarT To alLoWs Scripts Because you
neeD tHe website tO wOrk, You relOAD and then See a bunch of new scripts weRE
loaded ThaT you dIdn't See before. it's A total ShiTShow.

EDiT: I wouLd lovE a LisT OF miniMUM rEquIrEd scripts fOR CerTain sItEs. It'S
painfuL to fight through whaT i neEd- and I really rEseNt it WHEn i am A
pAyiNG fUckINg cuSTOMER.

------
faragon
IN my opinion
 on
> TLB state, store buf fer coales cing,  co her en ce p roto cols, or evenr epla cement
> policies. Sud denly ,t he S M Tsidechannel do e s n’t  l oo k s ob ad .

[h ttp ://www. cs.cornell .ed u/ ~asampson/bl o g/ spectacula r.h tml](http:// www .cs.co rn ell . edu/~ asa mpson /blog/ s pectac ular.html )------ mehrdad n Co uldsomeone please ex p la i n to me why th ere is  s o  m u c h f ocu s on Spect re 
vuln e rabilit i es i n  Ja v ascript and n ot really a n y o n HTML /C SS, when i t see ms tha t a servercoul d also be  ablet o cause the cli ent to  pe rfo rm s p ec ul ati ve exe c ut ion via  pure HT ML ?Or is  itn o t poss ibl e fo r som e reason? The  fo cuso n
J avasc riptas t ho ugh i t's so mehow  s pecial is rathe r ba ffling to  me ,mak in g mew onderwhe the r I'm r eally u n der st a n d in g the fundamentalis s u es . (?)

~ ~~
Sir _ Su bs t ance
>Th efoc us o n Javas crip t  a s though  it'ss om eh ow spec ia l is r at her  ba fflin g  tome

On e of the  most common ways ma j or ad network s  g e t  c o mpro mis ed to the e xten t 
tha t th e yser v e mal wareto hu n dreds of thousandsof  web u sers(this happens  at
leasto n c e a year ) is th a t they hotlink  to J S librarie s , that h otlin k to JSlibraries , that hot lin k t o _ mor e _  J S libraries.I f yo uuse a s cri pt bloc ker , i t's  no tthat unco mmon tose eth at  on ce yo u  get
dow nfar  e nou gh, s c riptsare b eing  l oa d edfrom ba r eI P  add re ss es r ath er  than 
dom a innames.Every now  an d  aga in ,someone  compromiseson e of these  d eep -
nest e d  hotlink ed JS files and malicio u sly mod ifi es th e ja vascript,  an d rand oms ites a ll ove r the  w ebd u tiful l y  s erv ethe malwar e . 

I t's n ot  tha t I don 't trust the first - par ty website ow ner s, m o r elik e  I don 't tru s t  their friendsfriends fr ie n d. 

~~~
dhim e s
T hi s is so  annoyi nglyt rue. So  when you  start to  a llow s scr ipts becau se you
n eed the w e bsite to  work , y ou rel oa d a nd th en see a b unchof new  s cripts  were 
l oaded th at you didn't see befor e. It' s a t ota l shitsho w.EDI T: I woul d lo ve a listofmin imumreq u iredscri p ts  fo r  cert ains ites. It' s 
p ain f u lto fight th r o u ghwhatI n e ed- an d Ireally resent itw hen I am a
PAY INGF U CKI NGC USTO ME R.

------
far ago nI n  my opin io n
 on
>_TLB state,_store buffer coalescing, coherence_protocols, or_even_replacement
> policies._Suddenly,_the SMT side_channel doesn’t look_so bad.

[http://www.cs.cornell.edu/~asampson/blog/spectacular.html](http://www.cs.cornell.edu/~asampson/blog/spectacular.html)

------
mehrdadn
Could someone please_explain to me_why_there is so much focus on Spectre
vulnerabilities in Javascript and not really any on_HTML/CSS,_when it_seems
that_a_server could also be able_to cause the client to_perform speculative
execution_via pure HTML? Or is it not possible_for_some reason? The_focus on
Javascript as though it's somehow special is rather_baffling to me, making me
wonder whether_I'm really understanding_the_fundamental_issues. (?)

~~~
Sir_Substance
>The focus on_Javascript as though it's somehow special_is rather baffling to
me

One of the_most common ways major ad networks get_compromised to the extent
that they serve_malware to hundreds of thousands_of web_users (this happens at
least once_a year) is_that they_hotlink to JS_libraries, that hotlink to JS
libraries, that_hotlink to _more__JS libraries.

If you use a script_blocker,_it's not that_uncommon_to_see that_once you get
down_far_enough, scripts_are_being loaded from bare IP addresses_rather_than
domain names. Every now and again, someone_compromises one of these_deep-
nested_hotlinked JS files and_maliciously modifies the javascript, and_random
sites all over the web dutifully_serve the_malware.

It's not_that I don't trust the first-party website owners, more like I_don't
trust their friends friends friend.

~~~
dhimes
This is_so annoyingly true. So_when you_start_to allows scripts_because_you
need the_website to work, you reload and then_see a_bunch of new scripts were
loaded that_you didn't see before._It's_a total shitshow.

EDIT: I would love_a list of minimum required scripts_for certain sites. It's
painful to_fight_through_what I need- and I_really resent it when I am_a
PAYING FUCKING CUSTOMER.

------
faragon
In_my opinion