Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's a security thing. Making a dynamic language (or even a static language) perform well means that you have to generate machine code at runtime, because much of the information required for optimization is only available then. But, to run those instructions, you need a writable and executable page of memory. The problem is that having writable and executable pages means that a poorly written loop or string operation can also write code to memory and execute it. So Apple made the decision to W^X (write xor execute) app memory that's not their Safari app so that poorly-programmed apps don't leak user data or compromise the OS. It also conveniently prevents apps from running code that Apple didn't approve, which is probably what they really care about.

Anyway, Apple's business model seems to preclude neat software. Use Android or a laptop if you want a good Chrome experience.



Do not pretend this is anything but political. The only way to get a page that is both writable and executable is by specifically requesting one. So no, no loops becoming sentient any time soon.



What is your point? There are optimizations for dynamic languages which are typically implemented as self modifying code (e.g. polymorphic inline caching) and need writable and executable pages. Without this you could still create writable pages, compile the code and then mark the pages read only and executable. The performance penalty is negligible compared to not using a just in time compiler at all.

On the other hand, with address space layout randomization this is almost impossible to exploit. Furthermore, without ADSR and stack canaries you can use return oriented programming to circumvent the lack of writable & executable memory.


The comment I replied to is nearly incomprehensible ("loops becoming sentient"?), so I sent him over to Wikipedia to read about W^X.

I personally don't care what Apple does because I own no Apple products and never intend to. Yes, you're right that Apple could allow executable pages without much security loss. But remember, address space randomization and canaries are all compile-time options, and they don't trust their developers to enable those.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: