Safely Reviving Shared Memory

https://hacks.mozilla.org/2020/07/safely-reviving-shared-memory/

by MindGods • 6 years ago

174 84 6 years ago

hacks.mozilla.org

Santosh83• 6 years ago

So how will these headers work for shared hosting sites where you normally cannot modify the hosting provider's HTTP server?

simlevesque• 6 years ago

You can set headers with .htaccess.

birdyrooster• 6 years ago

And boy do they, I used to be a shared hosting administrator and sometimes people would do stupid things like create 10MB .htaccess files with the subnets of all of the countries they wanted to block and then would call to complain that their site was loading slow. (Probably not a great idea to parse a config file for every request but at least it exists)

danudey• 6 years ago

Only in specific situations, where the site is using Apache and has .htaccess files enabled. I would argue that using Apache in the first place is non-optimal, but enabling arbitrary .htaccess files for clients is also a potential disaster.

Then again, I suppose there are enough people out there who just want to FTP up their wordpress code and call it a day, so... ugh.

zelly• 6 years ago

You only need this if you're doing multithreaded WebAssembly. The typical applications that need that (e.g. games) also require a huge amount of infrastructure, let alone a web server config.

pjmlp4• 6 years ago

Flash games don't need a huge amount of infrastructure.

gridlockd6• 6 years ago

"The system maintains backwards compatibility. We cannot ask billions of websites to rewrite their code."

I don't understand this requirement. Very few sites use SharedArrayBuffer, those few that do probably had to rewrite code to deal with it being disabled.

I also don't understand how cross-origin has anything to do with it either. Either your sandbox works, in that case cross-origin isolation shouldn't matter, or it doesn't work, in which case cross-origin isolation is not a real protection.

Am I missing something here?

Firefox is only maybe 5% of users and it has other performance problems, if SharedArrayBuffer doesn't "just work" then I'm inclined to have them take that performance hit or use a different browser.

jefftk• 6 years ago

To safely use SharedArrayBuffer you have to give something else up, like the ability to fetch arbitrary resources with <img>. Most sites that want SharedArrayBuffer would be fine with a tradeoff like this, and so this post describes a way they can opt in to the necessary restrictions.

dfabulich3• 6 years ago

Under Spectre, if the attacker can run SharedArrayBuffer code in your process, even "sandboxed," it can read memory from anywhere else in that process.

https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zME...

So I guess you're right that if the sandbox "works" you don't care about cross-origin isolation, but it turns out that sandboxes don't work if you run multiple sandboxes in the same process.

The mitigation browsers have chosen is to isolate each origin in its own process, preventing other origins from communicating with it. To regain access to SharedArrayBuffer, you have to opt in to this extreme form of cross-origin isolation.

It would be nice to just make the whole web default to cross-origin isolation, but tons of websites rely on cross-origin communication features, and browsers can't just force them all to be compatible with isolation, so isolation has to be opt-in.

gridlockd6• 6 years ago

How exactly does site-isolation prevent cross-origin communication that doesn't rely on SharedArrayBuffer, i.e. that vast majority of use-cases? It's just message passing.

I can see that site-isolation is arguably too expensive on mobile and why you might want an opt-in mechanism there, somewhere down the line.

However, I don't think there are good arguments for not just enabling it on Desktop right now, without making developers jump through hoops. Until Chrome enables SharedArrayBuffers on mobile, I have no reason to care anyway.

topspin• 6 years ago

I don't understand this requirement.

Why? It's a straightforward matter. You can have the conventional behavior with the necessary limitations to which everyone has adapted, or you can opt in to a modified environment with new rules that would break some sites but provides additional capabilities.

Am I missing something here?

Yes; the clearly explained rational is somehow being missed. The sandbox is an OS process as necessitated by Spectre. Without the new opt-in capability content from multiple origins -- some of them hostile -- are mixed into a process, and so the shared memory capabilities must be disabled. This new opt-in capability creates the necessary mapping; when enabled the content from arbitrary origins will not be mixed in a process and so the shared memory and HRT features can be permitted.

gridlockd6• 6 years ago

Without the new opt-in capability content from multiple origins -- some of them hostile -- are mixed into a process, and so the shared memory capabilities must be disabled.

That's an arbitrary requirement on the part of Firefox developers, and it's a security issue in its own right. Any of the numerous exploits that regularly show up in Firefox could take advantage of this, not just Spectre.

Chrome has site-isolation enabled by default, at least on Desktop, I don't see why Firefox shouldn't follow suit.

ori_b• 6 years ago

I also don't understand how cross-origin has anything to do with it either. Either your sandbox works, in that case cross-origin isolation shouldn't matter, or it doesn't work, in which case cross-origin isolation is not a real protection.

It doesn't work in general. It kind of works if you're putting each sandbox into its own process. Assuming there aren't any undiscovered microarchitectural attacks at the moment.

pjmlp4• 6 years ago

Nice to see it is eventually going to be re-enabled, however if Firefox doesn't make it as easy as Chrome, that is what most costumers will focus on regarding applications that make use of threading alongside WebAssembly.

domenicd2• 6 years ago

In Chrome we already require these headers on mobile, and plan to require them on desktop soon.

pjmlp4• 6 years ago

Fair enough, so far I only toyed around with the desktop version.

Just making a note that if you want to foster PWAs over native, or Electron workarounds, better not make us jump through many hoops.

dfabulich3• 6 years ago

In this article, Mozilla refers to new HTTP headers, COOP and COEP, that can be used to opt-in to cross-origin isolation and thereby grant access to features that would be dangerous under Spectre side channel attacks.

IMO, this Google doc is a better explainer of COOP and COEP, how they work, and why they help.

https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zME...

"We now assume any active code can read any data in the same address space. The plan going forward must be to keep sensitive cross-origin data out of address spaces that run untrustworthy code, rather than relying on in-process checks."

domenicd2• 6 years ago

The following articles also go into more detail:

- https://web.dev/coop-coep/ - https://web.dev/why-coop-coep/

although I think the Mozilla article in the OP is a really nice, succinct high-level overview.

ekr• 6 years ago

I may sound like a grumpy old man, but I really really dislike this non-stop influx of complexity into every level of the stack. This is a clear case of an abstraction leaking. Microprocessor vulnerabilities should never lead to changes in a high level application protocol like that.

The work needed to implement an HTTP server is growing and growing and growing. There was some speculation a few days ago on why this is happening, and why big companies are benefiting from this. I don't think there's any conscious conspiracy anywhere, just a lot of people try to make a name for themselves. (There was a discussion on this a few days ago here: https://news.ycombinator.com/item?id=23833362)

But I just hate this growing complexity everywhere. HTTP can and should be much simpler than it's becoming.

joosters• 6 years ago

None of these changes impact HTTP server code. Pages that run javascript might want to set some new headers, but setting headers is something that web servers always have to do. Changing a site config to send some new headers is work for a web page creator, not the HTTP server developer. And the changes are backwards compatible, so you don't actually need to do anything if you don't want to.

This new complexity is about javascript execution, and creating a browser that can run javascript has never been simple!

drewm1980• 6 years ago

Can I one-up your rant? We're in an era where complexity has gotten so out of hand, our phones catch on fire under the computational burden of sending text messages!

magicalist• 6 years ago

The work needed to implement an HTTP server is growing and growing and growing.

It's a header. We've all had 25 years to get those implemented :)

Razengan• 6 years ago

We need something better than the web.

Let’s start by making native apps as instantly accessible as websites — iOS App Clips are a step in that direction.

Next, let people share links into native apps.

hnick• 6 years ago

I don't think there's any conscious conspiracy anywhere

Nor is it required, see evolution. Completely non-directed, but the beneficiary still benefits which reinforces the change.

It feels like some kind of selection pressure where big companies pollute the world with complexity to remove competition. This can be intentional of course, but even if it's an accidental random mutation then the result is the same.

nazgulsenpai• 6 years ago

I played with the K on the word HACKS at the top of the screen for far too long.

azmenak• 6 years ago

While still a ways away, its great to see progress on this front. After SABs were disabled, the use cases and power of WebWorkers shrank considerably.

Very excited to dive back into some WASM/WebWorker projects that got abandoned due to performance limitations.

waynecochran4• 6 years ago

Imagine what the world would be like if didn't need to worry about bad actors. This is a considerable amount of engineering energy to make this safe.

I know safety isn't all about about malicious attacks, but I like to imagine living in a world without the need for locks, passwords, keys, safes, signatures, contracts, lawyers, ... we would probably all be fed and populating the solar system by now.

IgorPartola5• 6 years ago

I have a hard time imagining such a world precisely because being a bad actor is a part of our DNA and the DNA of many many animals, plants, bacteria, and fungi we interact with. The unintended consequence of lack of selfishness could be mind boggling. Think about it this way: Silicone Valley mostly provides the last 5% of the tech needed to make any given product. You know where the rest comes from? Military tech that eventually makes its way to civilian use. Things like semiconductors, the Internet, GPS, rocket propulsion, etc. No conflict == no military == no tech == we wouldn’t be having this conversation. I am definitely not saying we couldn’t all be a whole lot nicer to each other. But I am saying that we wouldn’t be human if that was wired into us.

clusterfish• 6 years ago

The military's role in this seems very much rooted in selfishness and adversity, to the extent that a more cooperative species (let's be honest it's not gonna be us) would find plenty of non-military motivation to do similar amounts of basic and applied research.

strbean• 6 years ago

Silicone Valley mostly provides the last 5%

Typo? Or are we finally acknowledging the contributions of the porn industry? :)

waynecochran4• 6 years ago

Do you think ancient Rome could have landed someone on the moon had they not fell?

adamsea2• 6 years ago

Yeah but as humans we have an ability to learn and change.

eru4• 6 years ago

Your estimation of the military is way off, I suspect.

Hey, these days the military is using consumer grad iPads, because they are cheaper and good enough.

There are more things in heaven and earth than just the military and SV.

One big example that's often brought up of military tech leading the way is programmable computers. And, yes, in our history that's what happened. But International Business Machines was hot on their heels purely for commercial computing. (If the militaries of the world hadn't blown up so many resources, business would have likely come up with programmable computers a few years earlier, thus completely eliminating the gap.)

RcouF1uZ4gsC• 6 years ago

In that world, since you don’t have bad actors, you would likely be ruled by a benevolent king or queen.

A large part of why have democracy and separation of powers is to protect from bad actors.

But yeah, not having to deal with bad actors can enable massive achievements. The pyramids were built when Egypt was more or less safe from any external invasion and ruled by god-kings who could coordinate massive building projects.

waynecochran4• 6 years ago

Yeah, it has always been in the thoughts of mankind to have a benovolent, righteous king to even the point where the natural world and the animal kingdom would be in harmony. If the events of Isaiah 11 ever come to fruition, I imagine we'll cure cancer, have quantum computers, and unlock the mysteries of the universe.

m4rtink2• 6 years ago

The problem with an enlightened and benevolent ruler is that even if he really is that good (and history uncovers a lot of dirt even for rulers popularly known as enlightened and benevolent) what do you do when they die or decide to quit ? Their children could be insane psychopats unfit to rule (as indeed often demonstrated in history) or there would be a civil war with various factions trying to fill the power vacuum.

With all its faults democracy has these edge cases handled and makes the elected group of rukers much more acountable with mens to get ridd of they if they turn out to be too unfit to rule.

eru4• 6 years ago

What do you even need a government (with a benevolent leader at the top) for, if you don't have any bad actors?

naringas• 6 years ago

...and no religion too

[cue John Lenon at the piano]

waynecochran4• 6 years ago

Yes, religion tends to make lots of bad actors. That is why Jesus excoriated the religious in Matthew 23.

x87678r• 6 years ago

You need an intranet job at a corporate with on prem servers and firewalls. Its much simpler.

sjnu• 6 years ago

Yes, ignoring the problem is easier.

octetta• 6 years ago

I would love to live in that world. Here’s hoping for human evolution.

smabie2• 6 years ago

So you're saying our genes are going to compete and evolve so that we no longer compete and evolve? That's not how it works.

But a less flippant way to put it is that a world without "bad" actors isn't a stable equilibrium. It cannot and will not ever happen. If you need convincing, look to nature. An equilibrium is only formed through a multitude of mixed strategies.

Artificial selection might result in what you desire, but that would be.. unpopular, to say the least.

beervirus• 6 years ago

It would look a lot like the internet did 25-30 years ago.

adamsea2• 6 years ago

Except with lots more people ; )

modeless• 6 years ago

Cool! Looks like SharedArrayBuffer will be re-enabled next week with the release of Firefox 79: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Rel...

This will be big for Web Assembly. Real threads will make it possible to port more stuff and get better performance.

burfog• 6 years ago

It's better performance for one web site, at the expense of whatever may be in other tabs or even outside the browser.

I really don't want to grant that.

Web browsers are failing badly at resource controls. I don't want to hand my whole computer over to a greedy web site. I expect my browser to stop the abusive web site resource consumption, not enable it.

codys• 6 years ago

While I agree that browsers generally currently appear to exercise poor control over resources like cpu time and memory amount, I'm not sure that aiming to cripple all sites equally is the right tactic here. It seems like better "scheduling" and other resource management would be something that needs work regardless of whether we expose tools to improve web application performance to websites.

inetknght• 6 years ago

tl;dr:

`about:config` -> `dom.workers.serialized-sab-access` -> true

Otherwise you risk sites opting in to Spectre. Why Mozilla thinks this is a good thing is beyond me.

jdlshore• 6 years ago

This is either astoundingly bad reading comprehension, or a willful mischaracterization. The whole article is about what they're doing to prevent Spectre-like problems. The config option is their backup plan in case they made a mistake in their threat analysis.

All in all, I thought it was a sober and mature approach to the problem.

secondcoming• 6 years ago

The web is such a mess.

eximius• 6 years ago

Notably disappointing: Cross-Origin-Opener-Policy must be set on a page to isolate it as the default value is not safe.

i.e., if I have a page with sensitive client side data, I need to set this header to prevent a page on a different domain from opening a popup to that page then doing a Spectre-like attack on my web page and exfiltrating that sensitive client side data.

I don't actually entirely understand the purpose or effect of Cross-Origin-Embedder-Policy. I thought browsers already blocked cross origin requests without CORS headers in the response that allow it. Does this header UNDO that by default?

dragonwriter• 6 years ago

I don't actually entirely understand the purpose or effect of Cross-Origin-Embedder-Policy. I thought browsers already blocked cross origin requests without CORS headers in the response that allow it.

CORS applies to XHR/fetch APIs, not browser loading of subresources specified in the HTML of the page.

COEP optionally extends CORS-type protection to subresources.

Safely Reviving Shared Memory

Related Stories