undefined | Better HN

0 pointsbjourne7y ago0 comments

But the feature the exploit takes advantage of isn't just in time compilation, it is compilation! An ahead of time java compiler would have suffered from the exact same problem. In fact, any language compiling to machine code would be just as vulnerable.

0 comments

pitaj7y ago

Yes, but when pre-compiling, you implicitly trust the code. JITs like V8 are used to execute arbitrary code on your device, where such an exploit is much more harmful.

bjourneOP7y ago

Untrue. Dart code for example is AOT compiled but untrusted. Various Javascript implementations are also AOT but also supposed to be used for untrusted code.

pitaj7y ago

I have no idea what you're talking about. Under what circumstances is Dart AOT compiled and run untrusted? No browsers support Dart as a first-class citizen. If you're talking about compiling Dart into JS, that's obviously not what anyone is talking about.

There are no Ecmascript AOT compilers. By definition, Ecmascript must be run with an interpreter. AFAIK with the dynamic complexity of the language it's impossible to AOT compile even without things like `eval` and `new Function`.

A better example would be NaCl which as I understand it runs native machine code in a sandbox.

1 more reply

j / k navigate · click thread line to collapse

0 pointsbjourne7y ago0 comments

0 comments

pitaj7y ago

Yes, but when pre-compiling, you implicitly trust the code. JITs like V8 are used to execute arbitrary code on your device, where such an exploit is much more harmful.

bjourneOP7y ago

Untrue. Dart code for example is AOT compiled but untrusted. Various Javascript implementations are also AOT but also supposed to be used for untrusted code.

pitaj7y ago

A better example would be NaCl which as I understand it runs native machine code in a sandbox.

1 more reply

j / k navigate · click thread line to collapse