Hacker News new | ask | show | jobs
by frik 3084 days ago
Okay, so how can we deactivate ASM.js and WebAssembly? (in the light of Meltdown and Spectre)

The config in Chrome is broken, WebAssembly cannot be deactivated anymore with chrome://flags/#enable-webassembly , setting it to "deactivated" and it's still active.

4 comments

Asm.js is not necessary, simple JavaScript interpreter is enough. This demo used to work before most browsers implemented optimizers for Asm.js
Mozilla Foundation Security Advisory 2018-01 Speculative execution side-channel attack ("Spectre")

https://www.mozilla.org/en-US/security/advisories/mfsa2018-0...

You need to disable `SharedArrayBuffer` and `performance.now`, which Firefox already did.
chrome://flags/#enable-site-per-process is a mitigation that at least raises the bar a little. :/