denoland / denoland/deploy_feedback

Disabling timers (Spectre mitigation)

Open
#53 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
No language data
Stars
79
Forks
5
PR merge metrics
No merged PRs in 30d

Description

Hi there! Big fan of Deno Deploy.

One of the things I was curious about—and I'm not sure this is a security vulnerability "in the wild" as such—is the presence of functioning timers within functions. It seems like each function is a separate V8 isolate, but that the native JS timing APIs work as normal (see [here](https://clever-mouse-47-62988b1c.deno.dev/), source code [here](https://gist.githubusercontent.com/shanecurran/c1246b433e41d672a1bdcfd63b4cc29a/raw/69546e943edb9389a4079cce5e73a7c90d7ff03d/test.js)). I know these are hard to do in practicality, but this could potentially leave functions open to Spectre-like attacks (or timing side channel attacks in general).

Is more robust isolation on the roadmap? Or alternatively disabling timers as a quick fix? Cloudflare wrote a good post about why it was important to them [here](https://developers.cloudflare.com/workers/learning/security-model#step-1-disallow-timers-and-multi-threading).

Thank you!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.