Category Archives: SPECTRE

How meaningful are SPECTRE mitigations on single user desktops and workstations if the installed software is trusted?

Posted on by

What prompts this question is why some Spectre mitigations are considered meaningful on single user workstations or desktops.
When a piece of software is trusted by the admin or a user to run on a single user system, what is the purpose of… Continue reading How meaningful are SPECTRE mitigations on single user desktops and workstations if the installed software is trusted?→

How can a timing/cache side-channel attack be performed? How can attack know the time of which certain instructions are performed by the victim?

Posted on by

About timing my question is:
How can attack know the time of which certain instructions are performed by the victim?
And about the cache, how can attacker know which cache line is being accessed by the victim? Is this doable in "norma… Continue reading How can a timing/cache side-channel attack be performed? How can attack know the time of which certain instructions are performed by the victim?→

This Week in Security: Retbleed, Post-Quantum, Python-atomicwrites, and the Mysterious Cuteboi

Posted on by

Yet another entry in the “why we can’t have nice things” category, Retbleed was announced this week, as yet another speculative execution vulnerability. This one is mitigated in hardware for …read more Continue reading This Week in Security: Retbleed, Post-Quantum, Python-atomicwrites, and the Mysterious Cuteboi→

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don’t need to use the sharedArrayBuffer or other features?

Posted on by

COOP: cross origin opener policy
COEP: Cross origin embedder policy
Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the sharedArrayBuffer and some other precis… Continue reading COOP and COEP: Is there an advantage to enabling COOP / COEP if I don’t need to use the sharedArrayBuffer or other features?→

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

Posted on by

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown.
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-… Continue reading Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?→