[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Intel Microcode updates

Hi there

On 18/06/2019 20:21, Andrew McGlashan wrote:

It doesn't have to be JavaScript, it can be ANY scripting.

Or any code.
The whole idea of running software you don't know anything about is insane.

 When it
comes to an updated browser, the exploit relies upon very precise
timing differences between operations -- if the browser won't report
timing with enough precision, then the exploit cannot work reliably if
at all (probably not at all).

Now as for TB, well, one would hope (I don't now the answer), that
they too have implemented the same fixes that Mozilla made for Firefox
to thwart the success of an exploit as well, ie have timing being less
granular to be able to perform the exploit.

Anyway, if the CPU microcode can be attained for the older CPUs, then
the licensing issue with Debian providing it is no longer a concern (I
believe).  Refer https://01.org/mcu-path-license-2018

My CPU isn't even in the list of non-supported CPU's.
In Thunderbird I have JavaScript off. _ALWAYS_!
I Firefox it's off most of the time. It's only on with companies I know and trust. I have been doing things this way for decades. On top of that my Squid proxy server has a redirector with DNS-based blacklists (RBLs): If a website is known to have a leaky CMS it's replaced with a transparent GIF.


Reply to: