Hacker News Reader

Comment by nine_k | Hacker News Reader

Running many instances of various untrusted code on the same server is "new": it came with the cloud infrastructure.

Running many instances of various untrusted code on the same client machine is "new": it came with web apps, and with mobile apps.

Before several years ago, it was sort of a non-issue, because to exploit such a vulnerability one would need to write a virus or a trojan, and with this approach, there are many easier ways of privilege escalation.

Something like "cloud" existed likely on IBM mainframes under OS/VM [1] but System/370-compatible CPUs likely lacked all these exploitable speculative execution features.

[1]: https://en.wikipedia.org/wiki/VM_(operating_system)

View on HN

https://en.wikipedia.org/wiki/Time-sharing

Time sharing was very big in the 1970s, and non-OS/VM methods of sharing mainframes for batch processing were also big at times I'm less sure of.

Inviting complete randoms to routinely run untrusted code in your own security domain, as we do with browsers, that's "new". And thus the popularity of NoScript and uMatrix.

Indeed! Though time-sharing was more like a terminal server, or shared hosting, while OS/VM was more like a modern VM host.

It's interesting though why cross-process data exfiltration based on speculative execution was not tried with any success in the shared hosting environment of 1990s and early 2000s. I suppose it has something to do with the use of non-JIT-ted interpreted languages, like PHP, Perl, or SQL, on such hosting; you could not run an arbitrary native executable like you do in the cloud.

Another factor is that though speculative execution was first implemented in 1950s [1], it was either mainframes or RISC machines, and neither was used by the Intel-dominated shared-hosting environments.

[1]: https://en.wikipedia.org/wiki/Branch_predictor#History

> It's interesting though why cross-process data exfiltration based on speculative execution was not tried with any success in the shared hosting environment of 1990s and early 2000s.

According to several of the researchers who found Meltdown and/or Spectre, they'd always assumed Intel et. al. were too careful to let this happen, at least at useful data rates. But when they looked for reasons I forget, Katie bar the door!

Reply on news.ycombinator.com