Correct. Zac Hansen <xax...@gmail.com> schrieb am Sa., 6. Jan. 2018, 21:43:
> > There's no (meaningful) runtime performance difference between disabling > it at compile vs runtime, correct? > > > On Friday, January 5, 2018 at 9:33:12 AM UTC-8, Thomas Nattestad wrote: >> >> Hello users and embedders of V8, >> >> On January 3rd, researchers from Google's Project Zero >> <https://googleprojectzero.blogspot.com/2014/07/announcing-project-zero.html> >> disclosed a new class of attacks >> <https://googleprojectzero.blogspot.com/> which exploit speculative >> execution optimizations used by modern CPUs. >> >> As a user or embedder of V8, you may have questions regarding these >> attacks and if they have any implications for you. We’ve put together a >> new wiki page <https://github.com/v8/v8/wiki/Untrusted-code-mitigations> >> regarding this topic that should serve to answer some of your questions. >> >> The main takeaway is that if you are an embedder such as Node.js that >> only executes trustworthy code then there should be no security concerns >> from these attack methods. In order to take advantage of the vulnerability, >> an attacker has to execute carefully crafted JavaScript or WebAssembly code >> in your embedded environment. If, as a developer, you have complete control >> over the code executed in your embedded V8 instance, then that is very >> unlikely to be possible. >> >> V8 is including some mitigation strategies for these attack methods as >> part of V8 6.4.388.16. These will be on by default and we are putting them >> behind a build flag to give embedders the option of whether they are >> needed. More details can be found on the wiki page >> <https://github.com/v8/v8/wiki/Untrusted-code-mitigations>. >> >> Sincerely, >> The V8 Team >> > -- > -- > v8-users mailing list > v8-users@googlegroups.com > http://groups.google.com/group/v8-users > --- > You received this message because you are subscribed to the Google Groups > "v8-users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to v8-users+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- -- v8-users mailing list v8-users@googlegroups.com http://groups.google.com/group/v8-users --- You received this message because you are subscribed to the Google Groups "v8-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to v8-users+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
