Meltdown/Spectre and the Web

The recently-released Meltdown and Spectre CPU timing attacks affect virtually every user in some way; the consequences are profound. There are plenty of good write-ups on the topic, so I don't feel the need to re-iterate the technical details here. (See an easily digestible one from the Raspberry Pi project, and an in-depth analysis from Project Zero.)

What I do want to draw attention to is that these attacks are exploitable via web browsers.

The reason for this is that your web browser, by default, automatically downloads and executes programs without your knowledge or consent. Most commonly, web pages embed software in the form of JavaScript code. Because of the features available in modern JavaScript environments, CPU cache timing attacks are possible.

I spoke about the security issues of running these programs in your web browser back in 2016---it was a bad idea then, and it's still a bad idea now. I spoke further of privacy issues last year at LibrePlanet 2017. I encourage you to use extensions like NoScript to block the execution of JavaScript by default, and stop random people from treating your computer as a puppet to do their own bidding.