3 ms·
My (perhaps naive) understanding is that, for Spectre to be truly exploitable, an attacker must be able to execute code locally (I know of the JS POC but there
by f00zz 7y ago
My (perhaps naive) understanding is that, for Spectre to be truly exploitable, an attacker must be able to execute code locally (I know of the JS POC but there are browser mitigations). But if an attacker has an account in my system I'm already screwed anyway, as there are probably other privilege escalation vectors that are easier to exploit.
My laptop is not high-value so I'd rather just disable that stuff. I once timed a C++ build, with and without Spectre mitigations, and the difference was something like 20%.
- hajile 7y agoPrivilege escalation is the biggest issue I think. Users on modern systems don't actually run as admins by default which makes it much harder for malicious software to compromise the entire system. Consider the average user. You can remove almost all malware and viruses because they only install and run with user permissions. Without spectre mitigations, it wouldn't be very long before all that malware was installing itself at deeper levels where the only solution is blowing everything away completely. I'm sure there is also a DRM argument somewhere for people who like that kind of thing.
- smueller1234 7y agoJavascript runs locally. Eg. a quick search turns up: https://github.com/cgvwzq/spectre https://github.com/cgvwzq/spectre