3 ms·

Yeah, builds on my i7 Linux laptop are noticeably faster with Spectre mitigations disabled. Pretty sad that mitigations against a largely theoretical attack hu

• hajile 7y ago
  It's only theoretical because the majority of people are patched. Given that the possible vulnerability has been discussed since core was first released, I'd bet that certain 3-letter organizations have used this and similar exploits in the past against high-value systems.
  • f00zz 7y ago
    My (perhaps naive) understanding is that, for Spectre to be truly exploitable, an attacker must be able to execute code locally (I know of the JS POC but there are browser mitigations). But if an attacker has an account in my system I'm already screwed anyway, as there are probably other privilege escalation vectors that are easier to exploit. My laptop is not high-value so I'd rather just disable that stuff. I once timed a C++ build, with and without Spectre mitigations, and the difference was something like 20%.
    • hajile 7y ago
      Privilege escalation is the biggest issue I think. Users on modern systems don't actually run as admins by default which makes it much harder for malicious software to compromise the entire system. Consider the average user. You can remove almost all malware and viruses because they only install and run with user permissions. Without spectre mitigations, it wouldn't be very long before all that malware was installing itself at deeper levels where the only solution is blowing everything away completely. I'm sure there is also a DRM argument somewhere for people who like that kind of thing.
    • smueller1234 7y ago
      Javascript runs locally. Eg. a quick search turns up: https://github.com/cgvwzq/spectre https://github.com/cgvwzq/spectre
• account42 7y ago
  Relevant: make-linux-fast-again.com
  • f00zz 7y ago
    Nice, thanks!