# data[].attributes.body
*add 2nd y-axis to figure 6 to denote time/byte

# data[].attributes.body
*improve naive attack by utilizing page tables

# data[].attributes.body
*exclude naive approach ('fake metaobject') and elaborate more on later mitigations
+ evaluate mitigation in terms of time & space overhead

# data[].attributes.body
*replace case study A. attack on cryptographic library from meltdown&python to foreshadow-ng&javascript

# data[].attributes.body
1. KASLR can be exploited with primitive
2. page tables can be made 'hot' by black-box queries
3. pre-inspection can be done in the victim machine (*clarify in paper)

# data[].attributes.body
first approach to apply data leakage techniques on extracting dynamic, complex data objects (which many modern language systems exhibit)
+ even possible with only black-box query access

does not require any more assumptions from the underlying data leakage primitive, other than the existence of reflection.
+ these primitive by themselves are insufficient, needing a clever way to optimize and prune the data subject to extraction

# data[].attributes.body
limited information about performance (in terms of speed) of the attacks

# data[].attributes.body
evaluation needs clarification
1. how JIT-ROP exactly?
2. 527.84MBs vs 1,892 bytes?

# data[].attributes.body
key techniques are unclear
1. breaking KASLR
2. pre-inspection of initial metaobj. location

# data[].attributes.body
too many assumptions: break KASLR, extract page table, victim process layout similar with local process

# data[].attributes.body
minor issues:
- what are 'initial metaobjects' exactly?
- global variable name: 'secret_key'

# data[].attributes.body
too many assumptions:
read kernel objects and victim process
-> with these assumptions, why need this approach in the first place?

# data[].attributes.body
relatively little attention to mitigation -> not a good fit for DSN

# data[].attributes.body
reletively little content

# data[].attributes.body
only demonstrated python&meltdown, even though it claims it works on many languages and vulnerabilities

# data[].attributes.body
the attack would be most plausible cross-VM, but only demonstrated cross-process

# data[].attributes.body
straw-men alternatives

# data[].attributes.body
contribution is small

# data[].attributes.body
general idea (exploit reflection) is obvious

# data[].attributes.body
repetitive reading to avoid catastrophic error propagation -> not evaluated

# data[].attributes.body
dict. read optimization not evaluated

# data[].attributes.body
mitigation not convincing

# data[].attributes.body
writing quality sometimes poor