4 ms·

Spectre/Meltdown is a serious problem, but they matter only in shared environments (virtual hosting with multiple accounts per physical machine). Why the mitig

Spectre/Meltdown is a serious problem, but they matter only in shared environments (virtual hosting with multiple accounts per physical machine). Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/

als0 7y ago
It does exist in single user environments. What about a desktop/phone that runs untrusted code? e.g. every browser that supports JavaScript.
- atemerev 7y ago
  Yes, and this code is contained within the Javascript engine. Mitigations could be enabled only there.
  - danarmak 7y ago
    Disabling HT can't be done per-process. Since per-frame browser processes need to be protected from one another, you can't even run two browser processes on the same core in HT. And scheduling a browser process while leaving the second HT slot on the same core empty is even slower than turning HT off.
    - gmueckl 7y ago
      Somebody please explain to me why ripping out the JS JIT wouldn't work.
      - dfrage 7y ago
        In the most recent discussion of this it was reported that is no longer an easy option with Firefox: https://news.ycombinator.com/item?id=20012750 https://news.ycombinator.com/item?id=20012750 There's also a general impression that would be too slow for many web pages, and that comment noted it took minutes for logins using JavaScript cryptography to execute.
        gpderetta 7y ago
        It seems to me that most people will be willing to pay for slower js as opposed to an overall slower system.
        zzzcpan 7y ago
        Does it even need to be slower? Almost every single website out there is not a javascript app and so side channel attacks can be mitigated by simply having an rlimit-style CPU time limit after say a user action on a tab.
  - zzzcpan 7y ago
    Browsers rely on kernel/hardware mitigations. Google people even claimed it's impossible to fully mitigate those vulnerabilities in existing Javascript implementation in Chrome.
  - als0 7y ago
    It's the job of the OS to make sure one process can't read the memory of another process. What you're saying is that should now be the responsibility of the JavaScript engine as well as the OS.
danieldk 7y ago
Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). Most desktops and laptops run a boatload of untrusted code in the form of JavaScript.
- atemerev 7y ago
  How about enabling mitigations in Javascript engines?
  - danarmak 7y ago
    There aren't such mitigations to enable. There aren't even purely software kernel-level mitiations.
    - atemerev 7y ago
      > There aren't even purely software kernel-level mitiations. Some are there, otherwise they couldn't be disabled in Linux kernel for faster performance. Which means that they could be enabled on demand.
      - danarmak 7y ago
        Some are there, yes, but they're insufficient to provide security. You need both them, and the microcode changes, and to disable HT. I'm not sure what if anything the software changes do alone, they may mitigate some of the attacks, but not all of them.
  - ggg2 7y ago
    why do you think you control that? apple tries, and even then people already managed to run code via pdf engines; on android it's at least more clear you have no control. You probably have apps in your phone runnig rigth now that ship with their own JS engine for advertising purposes. Do you expect them to have all the necessary safeguards?
  - 7y ago
geofft 7y ago
> P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ I like this website because, like its namesake, it promotes a simplistic solution to a symptom of an underlying problem, as if the symptom were itself the problem, in a manner that appeals to those who believe that a just world only has simple problems with simple solutions, and with no discussion of unintended consequences and serious security risks and no consideration of why those who have actually studied the problem in depth advocate different, more complicated solutions.
tasubotadas 7y ago
Is there a way to do the same for windows?

als0 7y ago

It does exist in single user environments. What about a desktop/phone that runs untrusted code? e.g. every browser that supports JavaScript.

atemerev 7y ago
Yes, and this code is contained within the Javascript engine. Mitigations could be enabled only there.
- danarmak 7y ago
  Disabling HT can't be done per-process. Since per-frame browser processes need to be protected from one another, you can't even run two browser processes on the same core in HT. And scheduling a browser process while leaving the second HT slot on the same core empty is even slower than turning HT off.
  - gmueckl 7y ago
    Somebody please explain to me why ripping out the JS JIT wouldn't work.
    - dfrage 7y ago
      In the most recent discussion of this it was reported that is no longer an easy option with Firefox: https://news.ycombinator.com/item?id=20012750 https://news.ycombinator.com/item?id=20012750 There's also a general impression that would be too slow for many web pages, and that comment noted it took minutes for logins using JavaScript cryptography to execute.
      - gpderetta 7y ago
        It seems to me that most people will be willing to pay for slower js as opposed to an overall slower system.
        zzzcpan 7y ago
        Does it even need to be slower? Almost every single website out there is not a javascript app and so side channel attacks can be mitigated by simply having an rlimit-style CPU time limit after say a user action on a tab.
- zzzcpan 7y ago
  Browsers rely on kernel/hardware mitigations. Google people even claimed it's impossible to fully mitigate those vulnerabilities in existing Javascript implementation in Chrome.
- als0 7y ago
  It's the job of the OS to make sure one process can't read the memory of another process. What you're saying is that should now be the responsibility of the JavaScript engine as well as the OS.

danieldk 7y ago

Why the mitigations are even on by default, if the problem doesn’t exist for dedicated single user environments? (desktops/laptops/dedicated server hardware with no code from other users running). Most desktops and laptops run a boatload of untrusted code in the form of JavaScript.

atemerev 7y ago
How about enabling mitigations in Javascript engines?
- danarmak 7y ago
  There aren't such mitigations to enable. There aren't even purely software kernel-level mitiations.
  - atemerev 7y ago
    > There aren't even purely software kernel-level mitiations. Some are there, otherwise they couldn't be disabled in Linux kernel for faster performance. Which means that they could be enabled on demand.
    - danarmak 7y ago
      Some are there, yes, but they're insufficient to provide security. You need both them, and the microcode changes, and to disable HT. I'm not sure what if anything the software changes do alone, they may mitigate some of the attacks, but not all of them.
- ggg2 7y ago
  why do you think you control that? apple tries, and even then people already managed to run code via pdf engines; on android it's at least more clear you have no control. You probably have apps in your phone runnig rigth now that ship with their own JS engine for advertising purposes. Do you expect them to have all the necessary safeguards?
- 7y ago

geofft 7y ago

> P.S. https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ I like this website because, like its namesake, it promotes a simplistic solution to a symptom of an underlying problem, as if the symptom were itself the problem, in a manner that appeals to those who believe that a just world only has simple problems with simple solutions, and with no discussion of unintended consequences and serious security risks and no consideration of why those who have actually studied the problem in depth advocate different, more complicated solutions.

tasubotadas 7y ago

Is there a way to do the same for windows?