6 ms·

It's not just Anandtech. I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between

It's not just Anandtech. I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between microcode and OS patches is an afterthought, and when a new CPU hits the market the numbers are presented without the obvious disclaimer that these performance gains may evaporate within months. Some even perpetuate the "only relevant to datacenter" myth despite the fact that security researchers have shown to be able to exploit these vulnerabilities with JavaScript in the browser.

gameswithgo 7y ago
pc enthusiasts aren’t really into running javascript either.
- phpnode 7y ago
  I've seen a number of comments like this over the last few days and I don't really get it, gamers use the internet right? Vast overwhelming majority of them are going to be running javascript programs hundreds of times per day
  - gameswithgo 7y ago
    sure, and maybe browsers or os need some way to say “running untrusted code please turn off performance for a sec” for that use case. until then ill just use one tab at a time or disable js before i opt in for slow.
    - Wowfunhappy 7y ago
      I expect that the vast majority of PC gamers keep Javascript enabled in their browsers.
      - ChickeNES 7y ago
        CS:GO also uses JS for its new GUI, and there's already been one exploit that took advantage of it.
      - kingosticks 7y ago
        I wouldn't expect that. Is this the kind of thing that would be reported by the Steam hardware survey (if that's still a thing)? Edit: I took a look and it seems they don't ask/record that info. I apologise for the offence this idea seems to have caused someone.
        zapzupnz 7y ago
        Nobody was offended by the other. I think people are downvoting you and gameswithgo because you appear to be applying your own personal notions to an entire segment with little to no evidence. 'PC enthusiast' is such a blanket term to start with, so applying a blanket statement to such a group is obviously doomed to failure from the very start.
        kingosticks 7y ago
        And that's exactly what the parent did that I replied to. But I do appreciate the explanation, cheers.
        BubRoss 7y ago
        Why would steam's hardware survey report if JavaScript is enabled in browsers?
        kingosticks 7y ago
        Because its a hardware and software survey. I have a memory of them asking some extra questions but that was years ago. Either I remembered wrong (likely), they changed it, or they don't report it all.
- nullandvoid 7y ago
  Because downloading and running binaries of applications is much safer? From what i've seen web browser teams have taken the recent risks extremely seriously - I have sure had a worse track record of infection via downloading and installing software versus visiting sites with JS running
  - yc12340 7y ago
    > web browser teams have taken the recent risks extremely seriously Not really. They didn't even properly apply band-aids. Chrome and Firefox disabled number of features, that allow Javascript code to create high-precision timers. This makes exploiting slightly more difficult, but the gaping hole is still there — there is infinite number of ways to create a high-precision timer, just not as obvious as closed ones. Chrome has enabled Site Isolation on desktop, but haven't done it on Android (presumably, because of associated increase in memory consumption). All major browsers still allow Javascript to run in background, create CPU threads and consume unrestricted amount of CPU time. I don't believe, that any of them have mounted instruction-based defenses (lfence etc.), but I may be mistaken here.
- 781 7y ago
  Discord is huge in gaming/pc enthusiasts. Oh, and you use VS Code in your stream. I wonder what those two are written in...
  - AgentME 7y ago
    Those are bad examples because they both run unsandboxed. The recent CPU vulnerabilities aren't uniquely bad for Javascript specifically. They're bad for wanting to run unprivileged code. Javascript in regular web pages just happens to be the most obvious example of sandboxed code in desktop computers.
- CoolGuySteve 7y ago
  It would be nice if the mitigations could be applied per-core. Then the OS could set the affinity for processes like games that really don't care.
Macha 7y ago
Most places certainly retested CPUs in the wave of Spectre/Meltdown and at least the sources I've seen have mentioned Zombieload/MDS though they've yet to go back and rebenchmark CPUs due to the fact they're either prepping for or travelling to Computex currently. I'd expect most of them to have videos in the next month though.
keldaris 7y ago
I'm glad the PC enthusiast space hasn't succumbed to the wild hysteria caused elsewhere by the side channel issues. It's tiresome to see every new variation people come up with reported as a new apocalypse all over again. Half the reason I still pay attention is to find if there's a new Linux boot switch I need to turn on to disable some new performance regression. Even though I'm personally in the fortunate position not to have any reasonable exposure to these vulnerabilities, I wouldn't be particularly worried even if this wasn't the case. It's been well over a year since Meltdown and Spectre came out and there still hasn't been a single case of anyone successfully using these vulnerabilities to productive ends in the wild that I know of. Obviously, cloud computing vendors need to pay attention and there are legitimate business concerns that are affected by this, but insofar as personal computing goes? If people persist in the ridiculous notion that constantly running completely arbitrary code in naive sandboxes is a great idea, I imagine there will eventually be issues, but so far the issue seems to be vastly overblown in the popular media.
- dejaime 7y ago
  "Wild hysteria", what do you mean? Experts seem to be far from a hysterical, and go for a more technical language, benchmarks and all. And the mass that usually goes hysterical actually doesn't even know their CPUs are going to take a 20% performance hit next OS update, and probably won't even realize that.
  - keldaris 7y ago
    The conversation was about the (nominally technical as well as more mainstream) press, not the experts. My remark regarding "wild hysteria" was made in that context. Experts and competent users will do the same thing they always do - evaluate any and all mitigations in the context of the threat models relevant to their usecases and act accordingly. Whether depriving the mass of less technically inclined users of the performance they are used to with all the implications that entails (including for energy efficiency and other externalities) is a wise decision only time will tell.
    - coldtea 7y ago
walrus01 7y ago
> I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between microcode and OS patches is an afterthought, and when a new CPU hits the market the numbers are presented without the obvious disclaimer that these performance gains may evaporate within months. If you want useful benchmarks that show the performance impact, go to phoronix. "PC Enthusiast" websites care about gaming performance and single user desktop performance, and always have. This has been the same since I started following things when the fastest CPU available was a 300 MHz Pentium 2. Imagine how amazed we all were by the 1 GHz Slot A Athlon.
the8472 7y ago
Phoronix has multiple articles on the impact of those vulnerabilities, from small laptop to large server processors.
- sitkack 7y ago
  The lament was that the large enthusiast sites are staying hush hush, mostly to not bite the hand that feeds them. Because Phoronix cares is outside the argument.
- wtallis 7y ago
  The perk of being able to test on Linux is that it's much easier to fully automate testing. Unfortunately, their analysis tends to be shallow.
  - consp 7y ago
    Their audience is not mainstream but enthousiast And professionals. They do not provide in depth analysis since they probably know the reader can do that for themselves.
    - wtallis 7y ago
      That may have been true at one time, but the class of people who would consider themselves to be enthusiasts has broadened well beyond the class of people who can accurately judge how their workload corresponds to the benchmark results they're reading. The recent improvements in the Linux gaming situation have been a big contributor and has undoubtedly skewed the Phoronix audience.
      - bubblethink 7y ago
        Phoronix serves two important purposes that nobody else does. 1) It serves as a news aggregator for a lot of different open source communities. You'd think that a site called hacker news would do that, but ironically it doesn't. Most content here is either heavily web dominated, or just random drivel about being excellent in life. 2) He runs his standard battery of tests on everything. A lot of upstream projects don't seem to have that much emphasis on performance regression testing. He has uncovered a few regressions and reported them upstream on a few occasions.
microwavecamera 7y ago
It's rumored that companies like Intel and Nvidia will retaliate against review sites and publications for bad press coverage by slowing or cutting off access to preview release products for reviews.

gameswithgo 7y ago

pc enthusiasts aren’t really into running javascript either.

phpnode 7y ago
I've seen a number of comments like this over the last few days and I don't really get it, gamers use the internet right? Vast overwhelming majority of them are going to be running javascript programs hundreds of times per day
- gameswithgo 7y ago
  sure, and maybe browsers or os need some way to say “running untrusted code please turn off performance for a sec” for that use case. until then ill just use one tab at a time or disable js before i opt in for slow.
  - Wowfunhappy 7y ago
    I expect that the vast majority of PC gamers keep Javascript enabled in their browsers.
    - ChickeNES 7y ago
      CS:GO also uses JS for its new GUI, and there's already been one exploit that took advantage of it.
    - kingosticks 7y ago
      I wouldn't expect that. Is this the kind of thing that would be reported by the Steam hardware survey (if that's still a thing)? Edit: I took a look and it seems they don't ask/record that info. I apologise for the offence this idea seems to have caused someone.
      - zapzupnz 7y ago
        Nobody was offended by the other. I think people are downvoting you and gameswithgo because you appear to be applying your own personal notions to an entire segment with little to no evidence. 'PC enthusiast' is such a blanket term to start with, so applying a blanket statement to such a group is obviously doomed to failure from the very start.
        kingosticks 7y ago
        And that's exactly what the parent did that I replied to. But I do appreciate the explanation, cheers.
      - BubRoss 7y ago
        Why would steam's hardware survey report if JavaScript is enabled in browsers?
        kingosticks 7y ago
        Because its a hardware and software survey. I have a memory of them asking some extra questions but that was years ago. Either I remembered wrong (likely), they changed it, or they don't report it all.
nullandvoid 7y ago
Because downloading and running binaries of applications is much safer? From what i've seen web browser teams have taken the recent risks extremely seriously - I have sure had a worse track record of infection via downloading and installing software versus visiting sites with JS running
- yc12340 7y ago
  > web browser teams have taken the recent risks extremely seriously Not really. They didn't even properly apply band-aids. Chrome and Firefox disabled number of features, that allow Javascript code to create high-precision timers. This makes exploiting slightly more difficult, but the gaping hole is still there — there is infinite number of ways to create a high-precision timer, just not as obvious as closed ones. Chrome has enabled Site Isolation on desktop, but haven't done it on Android (presumably, because of associated increase in memory consumption). All major browsers still allow Javascript to run in background, create CPU threads and consume unrestricted amount of CPU time. I don't believe, that any of them have mounted instruction-based defenses (lfence etc.), but I may be mistaken here.
781 7y ago
Discord is huge in gaming/pc enthusiasts. Oh, and you use VS Code in your stream. I wonder what those two are written in...
- AgentME 7y ago
  Those are bad examples because they both run unsandboxed. The recent CPU vulnerabilities aren't uniquely bad for Javascript specifically. They're bad for wanting to run unprivileged code. Javascript in regular web pages just happens to be the most obvious example of sandboxed code in desktop computers.
CoolGuySteve 7y ago
It would be nice if the mitigations could be applied per-core. Then the OS could set the affinity for processes like games that really don't care.

Macha 7y ago

Most places certainly retested CPUs in the wave of Spectre/Meltdown and at least the sources I've seen have mentioned Zombieload/MDS though they've yet to go back and rebenchmark CPUs due to the fact they're either prepping for or travelling to Computex currently. I'd expect most of them to have videos in the next month though.

keldaris 7y ago

I'm glad the PC enthusiast space hasn't succumbed to the wild hysteria caused elsewhere by the side channel issues. It's tiresome to see every new variation people come up with reported as a new apocalypse all over again. Half the reason I still pay attention is to find if there's a new Linux boot switch I need to turn on to disable some new performance regression. Even though I'm personally in the fortunate position not to have any reasonable exposure to these vulnerabilities, I wouldn't be particularly worried even if this wasn't the case. It's been well over a year since Meltdown and Spectre came out and there still hasn't been a single case of anyone successfully using these vulnerabilities to productive ends in the wild that I know of. Obviously, cloud computing vendors need to pay attention and there are legitimate business concerns that are affected by this, but insofar as personal computing goes? If people persist in the ridiculous notion that constantly running completely arbitrary code in naive sandboxes is a great idea, I imagine there will eventually be issues, but so far the issue seems to be vastly overblown in the popular media.

dejaime 7y ago
"Wild hysteria", what do you mean? Experts seem to be far from a hysterical, and go for a more technical language, benchmarks and all. And the mass that usually goes hysterical actually doesn't even know their CPUs are going to take a 20% performance hit next OS update, and probably won't even realize that.
- keldaris 7y ago
  The conversation was about the (nominally technical as well as more mainstream) press, not the experts. My remark regarding "wild hysteria" was made in that context. Experts and competent users will do the same thing they always do - evaluate any and all mitigations in the context of the threat models relevant to their usecases and act accordingly. Whether depriving the mass of less technically inclined users of the performance they are used to with all the implications that entails (including for energy efficiency and other externalities) is a wise decision only time will tell.
  - coldtea 7y ago

walrus01 7y ago

> I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between microcode and OS patches is an afterthought, and when a new CPU hits the market the numbers are presented without the obvious disclaimer that these performance gains may evaporate within months. If you want useful benchmarks that show the performance impact, go to phoronix. "PC Enthusiast" websites care about gaming performance and single user desktop performance, and always have. This has been the same since I started following things when the fastest CPU available was a 300 MHz Pentium 2. Imagine how amazed we all were by the 1 GHz Slot A Athlon.

the8472 7y ago

Phoronix has multiple articles on the impact of those vulnerabilities, from small laptop to large server processors.

sitkack 7y ago
The lament was that the large enthusiast sites are staying hush hush, mostly to not bite the hand that feeds them. Because Phoronix cares is outside the argument.
wtallis 7y ago
The perk of being able to test on Linux is that it's much easier to fully automate testing. Unfortunately, their analysis tends to be shallow.
- consp 7y ago
  Their audience is not mainstream but enthousiast And professionals. They do not provide in depth analysis since they probably know the reader can do that for themselves.
  - wtallis 7y ago
    That may have been true at one time, but the class of people who would consider themselves to be enthusiasts has broadened well beyond the class of people who can accurately judge how their workload corresponds to the benchmark results they're reading. The recent improvements in the Linux gaming situation have been a big contributor and has undoubtedly skewed the Phoronix audience.
    - bubblethink 7y ago
      Phoronix serves two important purposes that nobody else does. 1) It serves as a news aggregator for a lot of different open source communities. You'd think that a site called hacker news would do that, but ironically it doesn't. Most content here is either heavily web dominated, or just random drivel about being excellent in life. 2) He runs his standard battery of tests on everything. A lot of upstream projects don't seem to have that much emphasis on performance regression testing. He has uncovered a few regressions and reported them upstream on a few occasions.

microwavecamera 7y ago

It's rumored that companies like Intel and Nvidia will retaliate against review sites and publications for bad press coverage by slowing or cutting off access to preview release products for reviews.