8 ms·

Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

114 points by m3nu 9y ago

Is it advisable to put off any device purchases until this issue is fixed in a new generation of CPUs? So in 1-2 years?

valleydeveloper 9y ago
I don't see either of the bugs going away for consumer hardware? Both are somewhat fundamental optimizations and does not affect running trusted software.
Pilfer 9y ago
The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.
- Shank 9y ago
  Isn’t the performance loss due to KPTI still a big factor for consideration? The security risk might not be huge but you’re still losing at least some performance due to added overhead on nearly every OS. I suppose you could disable it on Linux, but at that point it seems like you’re going against the tide.
- mkagenius 9y ago
  > The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/117337/ https://threatpost.com/inside-the-latest-apple-imessage-bug/...
  - mrunseen 9y ago
    Maybe OS-wide blocker for malicious JS?
    - Yetanfou 9y ago
      No thanks, just thinking about running 'Norton Anti-JS' (et al) on a server is enough to induce nausea. In other words, blocking 'malicious' code is reactive, not pro-active. Reactive solutions by definition end up solving yesterday's problems while being oblivious to today's - viz. liquids restriction in hand luggage.
  - Pilfer 9y ago
    iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.
    - ZenoArrow 9y ago
      Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.
      - barrkel 9y ago
        There are two components: the branch prediction needs to be trained (to get it to speculatively execute the right instructions on context switch to the victim process) and precise timing needs to be available (to exfiltrate data using differences in what got cached). Without executing code, it's difficult to see how the two components could be triggered. Loading complex file formats is structurally similar to interpreting code; the output of the interpretation is some data structure, rather than some side effect, but otherwise it's very similar. There may be some loaders that are controllable and configurable enough to be programmed by data - perhaps something in the video decoding space that isn't offloaded to dedicated hardware or GPU - but I think it would be tough to find. JS or a downloadable game (which already lets people in the front door) of some kind are the best vectors.
        ZenoArrow 9y ago
        Sure, JS was the most obvious attack vector, but my point was that it's not limited to JS. Any code that runs natively on an affected computer can exploit it. The only advantage JS has is that it's easier to get targets to run malicious code through a web browser. You seem to be in agreement with me on this.
    - et-al 9y ago
      Ugh.. when Apple introduced apps and stickers into iMessage, I knew it could be a vector for attacks. Too bad Apple doesn't give users the option to have only "text-only" messages.
- chrisper 9y ago
  Yep, until your "trusted code" (e.g. Apache, PHP,...) has a remote code execution vulnerability. This is such a dangerous advice... you should really only disable these things if: a) your computer is not connected to the internet in any way b) it is in a trusted environment
- teget 9y ago
  I wonder how long it will take to get the fixes to all electron/cef based applications.
taurath 9y ago
At scale or for personal use? If at scale, you probably don’t have an option because you need it now. If for personal use, we don’t know what the fix would look like, or whether there would be a perf hit. If you can hold off for a few years sure do it, but it’s not a huge part of the equation now. How long will this device last you? If less than 2 years buy now. Honestly very few reasons to wait. Everyone has this problem. The only thing I might wait for is clarification of the attack surface area of spectre since that can’t be patched but it seems like it’s difficult to pull off in most cases.
simcop2387 9y ago
I still bought. Even if there are changes to the systems in the future to address them at a lower level, it'll be at least one generation away probably two. The timelines on designing new CPUs are multi-year beasts because of the complexity, and with the next generation happening "soon" I doubt a redesign could be feasible for them. So your looking at what I'd guess is a year or so for any movement.
quantummkv 9y ago
Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing these bugs at CPU level will require changes in architectures. Such sweeping changes won't come for years. Intel has not made such a overhaul in years and AMD just made one.
- bartread 9y ago
  Quite. If Intel, AMD, and ARM just slam in fixes now and release as soon as they can, assuming that's even possible, there's a significant chance they'll introduce other security problems. To gain a high degree of confidence that hasn't happened will most likely require extensive design iteration, verification, and testing so, yeah, years unfortunately.
- sytelus 9y ago
  Looks like Intel is already out with a patch for Meltdown: https://www.theverge.com/2018/1/4/16850776/intel-meltdown-spectre-security-patch-immune-response https://www.theverge.com/2018/1/4/16850776/intel-meltdown-sp...
  - tambre 9y ago
    A microcode update, which simply enables some previously disabled features, that allow you to workaround the problem (ie. by clearing the branch prediction buffer). The hardware is still most definitely vulnerable to both Meltdown and Spectre, and will require software workarounds to hide the problems, which in turn will cause lower performance.
- javitury 9y ago
  > Unless you are building a server, it does not matter The average HN user is not the typical desktop/laptop user. I bet we use virtual machines, compilers, technologies like nvme, databases (postgres/mysql)... more often than the typical desktop/laptop user.
dawnerd 9y ago
I mean if you’re building a pc from scratch you could just factor in some overclocking to make up some of the performance loss I’d imagine. In the future we probably just won’t see the advertised speeds of chips increasing much IF the performance impact is as big as people are saying.
chrisper 9y ago
I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or look for alternatives. Other than that it should not make much difference for us "normal folks." Another truth is that there is / was so much misinformation out there. Finally, I wonder if there are going to be any optimizations to these fixes in the future?
- danieldk 9y ago
  The cynic in me is amazed how people complain about a loss of 0-30% in performance on the desktop (depending on the workload), but are completely happy to replace native applications by Electron applications and/or web applications. Of course, these may be disjoint sets of people. I think when it comes to most desktop workloads, the security issues are far more interesting and serious. And while Meltdown only affects Intel CPUs, Spectre affects all (?) out-of-order CPUs and there may be more/more effictive attacks in the future. So every fast, modern CPU is pretty much in the same boat and it will take some time for the dust to settle. So, I would just stick with the Intel CPU. You can vote with your wallet once one vendor decides to axe ME/PSP and/or properly mitigates Spectre-type attacks ;).
  - chrisper 9y ago
    The problem, I think, is a psychological one. No one likes to get stuff taken away. People were also annoyed how "bad" their VW drives after the diesel fixes. Even if you probably never hit the limits to feel the difference, just the thought that from now on your CPU could be slower than it was yesterday is annoying enough. But I agree with you. It is the wrong crowd that complains the loudest!
  - kazinator 9y ago
    If your CPU takes a performance hit, it will affect everything, including the non-native applications.
vbezhenar 9y ago
If you want Intel and can wait, I would wait. They should fix Meltdown bug and it'll increate performance significantly in some edge cases. I think they'll release such processor in 2018. Spectre won't be fixed for a long time, so it should not affect purchase decisions.
- vardump 9y ago
  2018 sounds a bit early. I'd say we'll be lucky to see engineering samples in 2019, generic availability in 2020.
vemv 9y ago
I'll refrain from buying an iMac Pro (which was on my roadmap) until the situation is fully clarified. I mean how frustrated would one feel if it turned out that one spent that amount of money in a computer that should be replaced asap?
keldaris 9y ago
There's no point in waiting. Neither Intel nor AMD will significantly adjust their roadmaps due to these issues simply because they don't realistically have the flexibility to do so. Evaluate your threat model in the context of Meltdown/Spectre and opt in or out of the mitigations accordingly. There are relatively few cases where the workload is both significantly affected by the mitigations and vulnerable to these attacks (Xen paravirtualization would be the prototypical example). Personally, I opt out of page table isolation, KASLR and any retpoline-style mitigations on my desktop systems and compute servers for performance reasons. Make sure you understand the implications of these choices if you go that way, though.
- kikoreis 9y ago
  Do you have actual facts to back up your first paragraph? If it's just an informed opinion, mine is: if you can, you should definitely wait before buying new server parts.
  - alltakendamned 9y ago
    You underestimate how long it takes to "patch" hardware. Having an opinion does not make it an informed one. Read the following thread: https://twitter.com/securelyfitz/status/949370010652196864 https://twitter.com/securelyfitz/status/949370010652196864
    - XzetaU8 9y ago
      "Come 2019 and 2020, other products in the pipeline will have more involved fixes that again improve performance over the software and quick fixes. The solution everyone wants is a full fix with no performance impact. I can't imagine that coming any sooner than 2021"
  - keldaris 9y ago
    I don't have any facts that aren't already public - the official as well as the leaked roadmaps of the CPU manufacturers and general knowledge of how the industry works. What I'm wondering is - what, specifically, do you think is it that's so worth waiting for at the moment?
DeepYogurt 9y ago
Buy the machine you need when you need it. If you don't need a new machine right now then yes delay that purchase.
donatj 9y ago
I was putting serious consideration into an iMac Pro but this has at the least made me stop to consider the options. I write and run a ton of multithreaded data processing scripts and really feel this is going to be a world of hurt for me. My last fully speced iMac has lasted me eight years, so I might just wait it out and perhaps pick up something far cheaper in the meantime.
foxhop 9y ago
Delay or upgrade by purchasing used hardware. I often buy my gear 3-4 years old from Ebay, it lets me upgrade without the sticker shock. This assumes you don't need the latest and greatest. I do this with laptops and server gear. This is similar to purchasing used cars, you can steadily upgrade with much less capital and therefore each purchase holds much less risk. Also it's much better for the environment.
- teej 9y ago
  Buying old or used hardware from 3-4 years ago does not protect you from Spectre/Meltdown.
  - foxhop 9y ago
    I never said it does. Buying new hardware today does not protect you from Spectre/Meltdown either, the new hardware shipping for the next year at least (and the stuff currently on the shelf) does not protect you. I suggested delaying a new purchase until the CPUs are fixed (who knows how long that will take) or upgrade by purchasing used to get a bump in performance regardless of the hardware flaw (which will still require software mitigation and thus have performance degradation). Most hardware worth using right now has the hardware flaw so you might as well upgrade (for performance) by purchasing used.
mhkool 9y ago
I would wait a month or so to get all information about this topic and evaluate it. As of now, it seems that AMD has an immediate fix that does not impact performance while Intel's immediate fix has a large performance impact. I do not understand why most people want to stick with Intel...
Hckr254 9y ago
If you upgrade your web browser, firmware (if not an apple or microsoft device), and OS you should be more than fine. There's not much else you can do now anyway, so just upgrade devices based on what features you want in a new device.
VoodooJuJu 9y ago
I would put off hardware purchases, but for a different reason - crypto miners. As I was researching parts to buy for a new rig, I realized that just a few weeks ago, some GPU models were about half the price they currently are. Apparently, something recently happened with Bitcoin and/or other cryptocurrencies that caused a spike in mining interest.

114 points by m3nu 9y ago

Is it advisable to put off any device purchases until this issue is fixed in a new generation of CPUs? So in 1-2 years?

I don't see either of the bugs going away for consumer hardware? Both are somewhat fundamental optimizations and does not affect running trusted software.

Pilfer 9y ago

The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.

Shank 9y ago
Isn’t the performance loss due to KPTI still a big factor for consideration? The security risk might not be huge but you’re still losing at least some performance due to added overhead on nearly every OS. I suppose you could disable it on Linux, but at that point it seems like you’re going against the tide.
mkagenius 9y ago
> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/117337/ https://threatpost.com/inside-the-latest-apple-imessage-bug/...
- mrunseen 9y ago
  Maybe OS-wide blocker for malicious JS?
  - Yetanfou 9y ago
    No thanks, just thinking about running 'Norton Anti-JS' (et al) on a server is enough to induce nausea. In other words, blocking 'malicious' code is reactive, not pro-active. Reactive solutions by definition end up solving yesterday's problems while being oblivious to today's - viz. liquids restriction in hand luggage.
- Pilfer 9y ago
  iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.
  - ZenoArrow 9y ago
    Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.
    - barrkel 9y ago
      There are two components: the branch prediction needs to be trained (to get it to speculatively execute the right instructions on context switch to the victim process) and precise timing needs to be available (to exfiltrate data using differences in what got cached). Without executing code, it's difficult to see how the two components could be triggered. Loading complex file formats is structurally similar to interpreting code; the output of the interpretation is some data structure, rather than some side effect, but otherwise it's very similar. There may be some loaders that are controllable and configurable enough to be programmed by data - perhaps something in the video decoding space that isn't offloaded to dedicated hardware or GPU - but I think it would be tough to find. JS or a downloadable game (which already lets people in the front door) of some kind are the best vectors.
      - ZenoArrow 9y ago
        Sure, JS was the most obvious attack vector, but my point was that it's not limited to JS. Any code that runs natively on an affected computer can exploit it. The only advantage JS has is that it's easier to get targets to run malicious code through a web browser. You seem to be in agreement with me on this.
  - et-al 9y ago
    Ugh.. when Apple introduced apps and stickers into iMessage, I knew it could be a vector for attacks. Too bad Apple doesn't give users the option to have only "text-only" messages.
chrisper 9y ago
Yep, until your "trusted code" (e.g. Apache, PHP,...) has a remote code execution vulnerability. This is such a dangerous advice... you should really only disable these things if: a) your computer is not connected to the internet in any way b) it is in a trusted environment
teget 9y ago
I wonder how long it will take to get the fixes to all electron/cef based applications.

taurath 9y ago

At scale or for personal use? If at scale, you probably don’t have an option because you need it now. If for personal use, we don’t know what the fix would look like, or whether there would be a perf hit. If you can hold off for a few years sure do it, but it’s not a huge part of the equation now. How long will this device last you? If less than 2 years buy now. Honestly very few reasons to wait. Everyone has this problem. The only thing I might wait for is clarification of the attack surface area of spectre since that can’t be patched but it seems like it’s difficult to pull off in most cases.

simcop2387 9y ago

I still bought. Even if there are changes to the systems in the future to address them at a lower level, it'll be at least one generation away probably two. The timelines on designing new CPUs are multi-year beasts because of the complexity, and with the next generation happening "soon" I doubt a redesign could be feasible for them. So your looking at what I'd guess is a year or so for any movement.

quantummkv 9y ago

Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing these bugs at CPU level will require changes in architectures. Such sweeping changes won't come for years. Intel has not made such a overhaul in years and AMD just made one.

bartread 9y ago
Quite. If Intel, AMD, and ARM just slam in fixes now and release as soon as they can, assuming that's even possible, there's a significant chance they'll introduce other security problems. To gain a high degree of confidence that hasn't happened will most likely require extensive design iteration, verification, and testing so, yeah, years unfortunately.
sytelus 9y ago
Looks like Intel is already out with a patch for Meltdown: https://www.theverge.com/2018/1/4/16850776/intel-meltdown-spectre-security-patch-immune-response https://www.theverge.com/2018/1/4/16850776/intel-meltdown-sp...
- tambre 9y ago
  A microcode update, which simply enables some previously disabled features, that allow you to workaround the problem (ie. by clearing the branch prediction buffer). The hardware is still most definitely vulnerable to both Meltdown and Spectre, and will require software workarounds to hide the problems, which in turn will cause lower performance.
javitury 9y ago
> Unless you are building a server, it does not matter The average HN user is not the typical desktop/laptop user. I bet we use virtual machines, compilers, technologies like nvme, databases (postgres/mysql)... more often than the typical desktop/laptop user.

dawnerd 9y ago

I mean if you’re building a pc from scratch you could just factor in some overclocking to make up some of the performance loss I’d imagine. In the future we probably just won’t see the advertised speeds of chips increasing much IF the performance impact is as big as people are saying.

chrisper 9y ago

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or look for alternatives. Other than that it should not make much difference for us "normal folks." Another truth is that there is / was so much misinformation out there. Finally, I wonder if there are going to be any optimizations to these fixes in the future?

danieldk 9y ago
The cynic in me is amazed how people complain about a loss of 0-30% in performance on the desktop (depending on the workload), but are completely happy to replace native applications by Electron applications and/or web applications. Of course, these may be disjoint sets of people. I think when it comes to most desktop workloads, the security issues are far more interesting and serious. And while Meltdown only affects Intel CPUs, Spectre affects all (?) out-of-order CPUs and there may be more/more effictive attacks in the future. So every fast, modern CPU is pretty much in the same boat and it will take some time for the dust to settle. So, I would just stick with the Intel CPU. You can vote with your wallet once one vendor decides to axe ME/PSP and/or properly mitigates Spectre-type attacks ;).
- chrisper 9y ago
  The problem, I think, is a psychological one. No one likes to get stuff taken away. People were also annoyed how "bad" their VW drives after the diesel fixes. Even if you probably never hit the limits to feel the difference, just the thought that from now on your CPU could be slower than it was yesterday is annoying enough. But I agree with you. It is the wrong crowd that complains the loudest!
- kazinator 9y ago
  If your CPU takes a performance hit, it will affect everything, including the non-native applications.

vbezhenar 9y ago

If you want Intel and can wait, I would wait. They should fix Meltdown bug and it'll increate performance significantly in some edge cases. I think they'll release such processor in 2018. Spectre won't be fixed for a long time, so it should not affect purchase decisions.

vardump 9y ago
2018 sounds a bit early. I'd say we'll be lucky to see engineering samples in 2019, generic availability in 2020.

vemv 9y ago

I'll refrain from buying an iMac Pro (which was on my roadmap) until the situation is fully clarified. I mean how frustrated would one feel if it turned out that one spent that amount of money in a computer that should be replaced asap?

keldaris 9y ago

There's no point in waiting. Neither Intel nor AMD will significantly adjust their roadmaps due to these issues simply because they don't realistically have the flexibility to do so. Evaluate your threat model in the context of Meltdown/Spectre and opt in or out of the mitigations accordingly. There are relatively few cases where the workload is both significantly affected by the mitigations and vulnerable to these attacks (Xen paravirtualization would be the prototypical example). Personally, I opt out of page table isolation, KASLR and any retpoline-style mitigations on my desktop systems and compute servers for performance reasons. Make sure you understand the implications of these choices if you go that way, though.

kikoreis 9y ago
Do you have actual facts to back up your first paragraph? If it's just an informed opinion, mine is: if you can, you should definitely wait before buying new server parts.
- alltakendamned 9y ago
  You underestimate how long it takes to "patch" hardware. Having an opinion does not make it an informed one. Read the following thread: https://twitter.com/securelyfitz/status/949370010652196864 https://twitter.com/securelyfitz/status/949370010652196864
  - XzetaU8 9y ago
    "Come 2019 and 2020, other products in the pipeline will have more involved fixes that again improve performance over the software and quick fixes. The solution everyone wants is a full fix with no performance impact. I can't imagine that coming any sooner than 2021"
- keldaris 9y ago
  I don't have any facts that aren't already public - the official as well as the leaked roadmaps of the CPU manufacturers and general knowledge of how the industry works. What I'm wondering is - what, specifically, do you think is it that's so worth waiting for at the moment?

DeepYogurt 9y ago

Buy the machine you need when you need it. If you don't need a new machine right now then yes delay that purchase.

donatj 9y ago

I was putting serious consideration into an iMac Pro but this has at the least made me stop to consider the options. I write and run a ton of multithreaded data processing scripts and really feel this is going to be a world of hurt for me. My last fully speced iMac has lasted me eight years, so I might just wait it out and perhaps pick up something far cheaper in the meantime.

foxhop 9y ago

Delay or upgrade by purchasing used hardware. I often buy my gear 3-4 years old from Ebay, it lets me upgrade without the sticker shock. This assumes you don't need the latest and greatest. I do this with laptops and server gear. This is similar to purchasing used cars, you can steadily upgrade with much less capital and therefore each purchase holds much less risk. Also it's much better for the environment.

teej 9y ago
Buying old or used hardware from 3-4 years ago does not protect you from Spectre/Meltdown.
- foxhop 9y ago
  I never said it does. Buying new hardware today does not protect you from Spectre/Meltdown either, the new hardware shipping for the next year at least (and the stuff currently on the shelf) does not protect you. I suggested delaying a new purchase until the CPUs are fixed (who knows how long that will take) or upgrade by purchasing used to get a bump in performance regardless of the hardware flaw (which will still require software mitigation and thus have performance degradation). Most hardware worth using right now has the hardware flaw so you might as well upgrade (for performance) by purchasing used.

mhkool 9y ago

I would wait a month or so to get all information about this topic and evaluate it. As of now, it seems that AMD has an immediate fix that does not impact performance while Intel's immediate fix has a large performance impact. I do not understand why most people want to stick with Intel...

Hckr254 9y ago

If you upgrade your web browser, firmware (if not an apple or microsoft device), and OS you should be more than fine. There's not much else you can do now anyway, so just upgrade devices based on what features you want in a new device.

VoodooJuJu 9y ago

I would put off hardware purchases, but for a different reason - crypto miners. As I was researching parts to buy for a new rig, I realized that just a few weeks ago, some GPU models were about half the price they currently are. Apparently, something recently happened with Bitcoin and/or other cryptocurrencies that caused a spike in mining interest.