denoland / denoland/deploy_feedback
Disabling timers (Spectre mitigation)
- Dominant language
- No language data
- Stars
- 79
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
Hi there! Big fan of Deno Deploy.
One of the things I was curious about—and I'm not sure this is a security vulnerability "in the wild" as such—is the presence of functioning timers within functions. It seems like each function is a separate V8 isolate, but that the native JS timing APIs work as normal (see [here](https://clever-mouse-47-62988b1c.deno.dev/), source code [here](https://gist.githubusercontent.com/shanecurran/c1246b433e41d672a1bdcfd63b4cc29a/raw/69546e943edb9389a4079cce5e73a7c90d7ff03d/test.js)). I know these are hard to do in practicality, but this could potentially leave functions open to Spectre-like attacks (or timing side channel attacks in general).
Is more robust isolation on the roadmap? Or alternatively disabling timers as a quick fix? Cloudflare wrote a good post about why it was important to them [here](https://developers.cloudflare.com/workers/learning/security-model#step-1-disallow-timers-and-multi-threading).
Thank you!
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.