7 ms·
OK, fun. What can we do to mitigate this until it gets patched?
by junek 2y ago
OK, fun. What can we do to mitigate this until it gets patched?
- thijsr 2y agoFrom the FAQ: > While FLOP has an actionable mitigation, implementing it requires patches from software vendors and cannot be done by users. Apple has communicated to us that they plan to address these issues in an upcoming security update, hence it is important to enable automatic updates and ensure that your devices are running the latest operating system and applications.
- omcnoe 2y agoSerious answer, don't use Safari. Use a browser that properly separates webpages into isolated processes so that this kind of cross-site read is not possible.
- amelius 2y agoWill that work? Isn't memory treated in a unified way between processes, at some point?
- goldsteinq 2y agoIt will work unless someone forgets to add a public suffix into the public suffix list (as described in the FLOP paper). Both of these attacks target virtual memory pointers.
- saagarjha 2y agoProcessors are not supposed to speculate across ASIDs
- goldsteinq 2y agoThere’re no other browsers on iPhone. Every iPhone browser is a reskin of Safari. They’re in theory supposed to allow other browsers in the EU, but AFAIK it has not happened yet.
- ragnot 2y agoGod I hate Apple sometimes
- prmoustache 2y agoThen don't use an iPhone until it is patched.
- hashstring 2y agoWhat about turn JS off on your favourite iOS browser?
- prmoustache 2y agoThat wouldn't prevent possible malware apps using WKWebview from getting out of the jail they are running out right?
- hashstring 2y agoYes, I agree. However I also expect that Swift-compiled apps can do this without a web browser component. It’s a different threat model though, having installed a malicious app vs browsing a malicious site.
- prmoustache 2y agoWhich is the reason alongside telemetry I tend to favor using websites over apps. Having said that there are apps that are considered mainstream and not malicious by the general population but can become a convenient backdoor for, say, a state actor.
- hmottestad 2y agoI wonder if Lockdown Mode would help?
- dmitrygr 2y agoIIRC, it disables jit and webassembly, so i think yes