Skip to content

Instantly share code, notes, and snippets.

@joakin
Created January 9, 2018 09:51
Show Gist options
  • Save joakin/253a9637aa49044bf915b3517dff5250 to your computer and use it in GitHub Desktop.
Save joakin/253a9637aa49044bf915b3517dff5250 to your computer and use it in GitHub Desktop.
Browser mitigations for meltdown & spectre

There were recently two very serious security vulnerabilities disclosed (Spectre & Meltdown) that affect pretty much anything that can run code on your machine.

That includes browsers, so major vendors have started rolling out mitigations for such attacks so that the vulnerabilities can't be exploited from JavaScript. Here is some info in case you haven't followed:

Summary

  • performance.now is going to be rounded to avoid exposing the high precision timer
    • to 1ms in Safari, 20µs in Firefox, 20µs with 20µs jitter in Edge, unspecified in Chrome
  • SharedArrayBuffer is going to be disabled for now since it can be used to create high precision timers from JS

Articles

Here are some articles from the different vendors. The Webkit one is more extensive and has approachable explanations, reasoning and links to commit, and is very interesting to read:

Conclusion

This changes shouldn't impact us at all in our usual browser work, but it is good to know about the changes of behavior to not be surprised if they do.

Hope this is useful, have a nice day!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment