3 ms·

I find it really unhelpful that these 'threads' are being hyped with little reference to any sort of thread model, reasonable attack vector or probability. I do

I find it really unhelpful that these 'threads' are being hyped with little reference to any sort of thread model, reasonable attack vector or probability. I do not want the kernel on my Arch laptop patched and slowed down to mitigate against issues that does not reasonably exist in the context of a laptop user. By all means patch my browser that runs random js. I'm not in the habit of downloading and running untrusted binaries - those that do have far greater problems than Meltdown or spectre already. Of course I want it patched on AWS, and my bank's backend machines, but you are now forcing me to continually pay, hour after hour, for insurance against a thread that I'm happy to not worry about. Do not steal my cycles to pay for 'security' I do not require.

tedunangst 9y ago
It's probably a trivial modification to disable KPTI for root owned processes.
- eecc 9y ago
  Or signed binaries that don’t execute user provided code, although there is still the potential to turn a local buffer overflow into a VM breakout... don’t think VPS provides will take that risk
megous 9y ago
Not sure why you're downvoted. It's a perfectly reasonable trade off. I'll be searching for ways to disable most of these mitigations too after the dust settles. I rarely run untrusted code, and for that I can probably find a way to run it securely depending on the perceived threat. A lot of what I do on my main computer is syscall heavy, and I don't like 25-50% performance hit.
- tzs 9y ago
  You could switch to TempleOS. :-) Meltdown is a much smaller (but not zero [1]) security risk on TempleOS than it is on Windows or Unix and Unix-like systems. [1] At first one might think there is no risk, because TempleOS runs everything at ring 0 in a single address space so anything that might be exposed via Meltdown is already wide open. That would be true in the case of running untrusted binaries. Where Meltdown would still affect TempleOS is in in the case of trusted binaries being exploited via techniques such as return oriented programming. Meltdown could make more "gadgets" available in the binary, increasing the chances that someone could make it read something it otherwise would not have read.
zer00eyz 9y ago
I have to wonder if there is a sound business decision in all of this to force upgrades on users. Im perfectly content with a several year old laptop for what I do but I realize that the performance hit from this patch is going to force my hand on an upgrade. Lets face facts, intel hasn't seen a lot of real gains for real world usage in a few years - this change adds bloat to software where it simply wasn't being generated before. Note: im not suggesting the issue was intentional but this unintended consequence has an upside for someone, the question is who.
jotm 9y ago
What can one actually gain access to with such an attack? And what if you have a firewall that only allows specific programs/services through? It would have to use the browser, but how, through an add-on that the user would have to install? Seems pretty complicated for a random machine, more likely to target government/company computers... I don't see why everyone is forced to install the updates.

tedunangst 9y ago

It's probably a trivial modification to disable KPTI for root owned processes.

eecc 9y ago
Or signed binaries that don’t execute user provided code, although there is still the potential to turn a local buffer overflow into a VM breakout... don’t think VPS provides will take that risk

megous 9y ago

Not sure why you're downvoted. It's a perfectly reasonable trade off. I'll be searching for ways to disable most of these mitigations too after the dust settles. I rarely run untrusted code, and for that I can probably find a way to run it securely depending on the perceived threat. A lot of what I do on my main computer is syscall heavy, and I don't like 25-50% performance hit.

tzs 9y ago
You could switch to TempleOS. :-) Meltdown is a much smaller (but not zero [1]) security risk on TempleOS than it is on Windows or Unix and Unix-like systems. [1] At first one might think there is no risk, because TempleOS runs everything at ring 0 in a single address space so anything that might be exposed via Meltdown is already wide open. That would be true in the case of running untrusted binaries. Where Meltdown would still affect TempleOS is in in the case of trusted binaries being exploited via techniques such as return oriented programming. Meltdown could make more "gadgets" available in the binary, increasing the chances that someone could make it read something it otherwise would not have read.

zer00eyz 9y ago

I have to wonder if there is a sound business decision in all of this to force upgrades on users. Im perfectly content with a several year old laptop for what I do but I realize that the performance hit from this patch is going to force my hand on an upgrade. Lets face facts, intel hasn't seen a lot of real gains for real world usage in a few years - this change adds bloat to software where it simply wasn't being generated before. Note: im not suggesting the issue was intentional but this unintended consequence has an upside for someone, the question is who.

jotm 9y ago

What can one actually gain access to with such an attack? And what if you have a firewall that only allows specific programs/services through? It would have to use the browser, but how, through an add-on that the user would have to install? Seems pretty complicated for a random machine, more likely to target government/company computers... I don't see why everyone is forced to install the updates.