Hacker News Reader

How this exploit would affect the average ssh based system? Would it enable a privilege escalation path for password-less SSH key based accounts?

Also, I thought it was common sense that sensitive data on RAM should be scrambled after use. There are many TLS implementations that scramble data on RAM after use, I thought Linux would’ve already implemented a similar system.

View on HN

You need to be able to run code on a machine. So server that you cannot log into isn’t vulnerable. This is for malware running as an executable or possible JavaScript through the browser (maybe web assembly too)

Browsers don’t expose the high accuracy time sources anymore that are needed for this attack.

So can this be fixed by making it more difficult to measure time, either through CPU ticks or multithreaded measurements? Can it be a privileged operation to have high accuracy timing?

IIRC cloudflare workers (a multi-tenant cloud environment) sets a static "current time" for each request and disallow multithreading to prevent accurate time measurements.

Reply on news.ycombinator.com