12 ms·

Many applications don't need Spectre or Meltdown mitigations, but they should at least put the test parameters up front and not in the fine print.

by sp332 7y ago

Tepix 7y ago
Many users won't know how to disable Spectre and Meltdown mitigations. They will be active by default if the user installs all the latest updates.
- stagger87 7y ago
  For some reason, I doubt people in the server/workstation space don't know how to do this, especially if they are leaving double digit percentage gains on the table if they don't.
  - computerex 7y ago
    You are not supposed to disable the mitigations... Especially on servers and workstations... And keep in mind that the usual mitigations aren't even holistic. The only truly 100% secure fix for Spectre/Meltdown is to disable hyperthreading altogether.
    - lonelappde 7y ago
      No. Spectre does not depend on hyperthreading, only speculative execution.
      - computerex 7y ago
        I was lumping them all into MDS class of vulnerabilities. It was misleading. https://linuxreviews.org/Microarchitectural_Data_Sampling:_The_Latest_Side-Channel_Vulnerability_In_Intel_CPUs#Full_protection_requires_SMT.2FHyperThreading_to_be_disabled https://linuxreviews.org/Microarchitectural_Data_Sampling:_T...
    - pmoriarty 7y ago
      Why shouldn't you disable them on servers that don't run Javascript or any other untrusted code?
    - icedchai 7y ago
      For servers that aren't running arbitrary third party code, like PaaS or IaaS, why not?
      - roblabla 7y ago
        If your server is running baremetal, no problem. If it's running on a shared hosting environment, a co-tenant VM can exfiltrate your data. See L1TF/Foreshadow.
        icedchai 7y ago
        Haven't all the big cloud providers have patched their hypervisors for that?
        computerex 7y ago
        You really want to rely on such assumptions for security?
        icedchai 7y ago
        It doesn’t keep me up at night.
crankylinuxuser 7y ago
The chips should be considered defective and "not as advertised" without spectre and meltdown in place. They fucked up, and are trying to pawn the slowdowns as some sort of Faustian choice.
gpm 7y ago
Many? Anything running a browser needs it because of js. Anything running connected to the internet at all would be well advised to have them because you can take advantage of the exploits via the network stack. Anything running on a vm has to have them since microcode is set by the hypervisor. So, we're talking about desktops not used to browse the internet, and bare metal servers whose network stacks aren't exposed to hostile actors?
- jolmg 7y ago
  > So, we're talking about desktops not used to browse the internet You can browse the internet without JS. Many people here seem to do so.
  - gpm 7y ago
    Technically true. The number of people who do isn't statistically interesting though. If you are I still wouldn't advise doing so while turning off the mitigations since you're still parsing and displaying hostile ip/tcp/http/(html/CSS/image/video/...). For example, http://www.misc0110.net/web/files/netspectre.pdf http://www.misc0110.net/web/files/netspectre.pdf
  - vkou 7y ago
    If you're browsing the internet without JS, you don't need a CPU that was built this decade to do so.
    - jolmg 7y ago
      Yet, Meltdown is said to probably effect every processor since 25 years ago[1], so I doubt people would have one from before then by chance or be willing to use it. [1] https://meltdownattack.com/#faq-systems-meltdown https://meltdownattack.com/#faq-systems-meltdown
      - lonelappde 7y ago
        Every Intel processor.
computerex 7y ago
You absolutely need Spectre/Meltdown mitigation otherwise someone could attack you with JavaScript running in your web browser. https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(again)_on_Intel_CPUs https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(... noibrs - We don't need no restricted indirect branch speculation noibpb - We don't need no indirect branch prediction barrier either nospectre_v1 and nospectre_v2: Don't care if some program can get data from some other program when it shouldn't l1tf=off - Why would we be flushing the L1 cache, we might need that data. So what if anyone can get at it. nospec_store_bypass_disable - Of course we want to use, not bypass, the stored data no_stf_barrier - We don't need no barriers between software, they could be friends mds=off - Zombieload attacks are fine mitigations=off - Of course we don't want no mitigations
- seminatl 7y ago
  You just leaped to the unfounded conclusion that every computer needs to run untrusted JavaScript. The vast majority of computers have no such need. Especially in a performance-sensitive contest like buying CPU for your database server that lives in a datacenter and never runs a web browser you will certainly disable these security things.
  - computerex 7y ago
    Disabling Spectre/Meltdown mitigations on a server especially would be the dumbest thing imaginable. These attacks are not restricted to JavaScript, they are side-channel attacks and have a huge exploitable surface. Just look at the number of patches for the MS SQL server needed to mitigate: https://support.microsoft.com/en-us/help/4073225/guidance-protect-sql-server-against-spectre-meltdown https://support.microsoft.com/en-us/help/4073225/guidance-pr...
    - reacharavindh 7y ago
      No, it is NOT the dumbest thing imaginable! If your server is not reachable from untrusted sources, and you are running only what you trust, it is prudent to disable mitigation’s and make use of the extra performance. Example, I run many compute nodes (only private network) in my HPC cluster with mitigation’s off. If an attacker could reach the compute nodes over the network to push the attack payload, I’ve already been heavily compromised that these attacks are just insult to the injury. If you run a database server that can never be reached directly by an attacker. You may spend your time watching your application server and let the DB server use the extra oomph.
loeg 7y ago
Appliances might be a better word than applications. If you've got a single privilege level (and that itself isn't a security design flaw), yeah, the info leak isn't a problem. HPCish environments are the obvious example.

Many applications don't need Spectre or Meltdown mitigations, but they should at least put the test parameters up front and not in the fine print.

by sp332 7y ago

Many applications don't need Spectre or Meltdown mitigations, but they should at least put the test parameters up front and not in the fine print.

Tepix 7y ago

Many users won't know how to disable Spectre and Meltdown mitigations. They will be active by default if the user installs all the latest updates.

stagger87 7y ago
For some reason, I doubt people in the server/workstation space don't know how to do this, especially if they are leaving double digit percentage gains on the table if they don't.
- computerex 7y ago
  You are not supposed to disable the mitigations... Especially on servers and workstations... And keep in mind that the usual mitigations aren't even holistic. The only truly 100% secure fix for Spectre/Meltdown is to disable hyperthreading altogether.
  - lonelappde 7y ago
    No. Spectre does not depend on hyperthreading, only speculative execution.
    - computerex 7y ago
      I was lumping them all into MDS class of vulnerabilities. It was misleading. https://linuxreviews.org/Microarchitectural_Data_Sampling:_The_Latest_Side-Channel_Vulnerability_In_Intel_CPUs#Full_protection_requires_SMT.2FHyperThreading_to_be_disabled https://linuxreviews.org/Microarchitectural_Data_Sampling:_T...
  - pmoriarty 7y ago
    Why shouldn't you disable them on servers that don't run Javascript or any other untrusted code?
  - icedchai 7y ago
    For servers that aren't running arbitrary third party code, like PaaS or IaaS, why not?
    - roblabla 7y ago
      If your server is running baremetal, no problem. If it's running on a shared hosting environment, a co-tenant VM can exfiltrate your data. See L1TF/Foreshadow.
      - icedchai 7y ago
        Haven't all the big cloud providers have patched their hypervisors for that?
        computerex 7y ago
        You really want to rely on such assumptions for security?
        icedchai 7y ago
        It doesn’t keep me up at night.

crankylinuxuser 7y ago

The chips should be considered defective and "not as advertised" without spectre and meltdown in place. They fucked up, and are trying to pawn the slowdowns as some sort of Faustian choice.

gpm 7y ago

Many? Anything running a browser needs it because of js. Anything running connected to the internet at all would be well advised to have them because you can take advantage of the exploits via the network stack. Anything running on a vm has to have them since microcode is set by the hypervisor. So, we're talking about desktops not used to browse the internet, and bare metal servers whose network stacks aren't exposed to hostile actors?

jolmg 7y ago
> So, we're talking about desktops not used to browse the internet You can browse the internet without JS. Many people here seem to do so.
- gpm 7y ago
  Technically true. The number of people who do isn't statistically interesting though. If you are I still wouldn't advise doing so while turning off the mitigations since you're still parsing and displaying hostile ip/tcp/http/(html/CSS/image/video/...). For example, http://www.misc0110.net/web/files/netspectre.pdf http://www.misc0110.net/web/files/netspectre.pdf
- vkou 7y ago
  If you're browsing the internet without JS, you don't need a CPU that was built this decade to do so.
  - jolmg 7y ago
    Yet, Meltdown is said to probably effect every processor since 25 years ago[1], so I doubt people would have one from before then by chance or be willing to use it. [1] https://meltdownattack.com/#faq-systems-meltdown https://meltdownattack.com/#faq-systems-meltdown
    - lonelappde 7y ago
      Every Intel processor.

computerex 7y ago

You absolutely need Spectre/Meltdown mitigation otherwise someone could attack you with JavaScript running in your web browser. https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(again)_on_Intel_CPUs https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(... noibrs - We don't need no restricted indirect branch speculation noibpb - We don't need no indirect branch prediction barrier either nospectre_v1 and nospectre_v2: Don't care if some program can get data from some other program when it shouldn't l1tf=off - Why would we be flushing the L1 cache, we might need that data. So what if anyone can get at it. nospec_store_bypass_disable - Of course we want to use, not bypass, the stored data no_stf_barrier - We don't need no barriers between software, they could be friends mds=off - Zombieload attacks are fine mitigations=off - Of course we don't want no mitigations

seminatl 7y ago
You just leaped to the unfounded conclusion that every computer needs to run untrusted JavaScript. The vast majority of computers have no such need. Especially in a performance-sensitive contest like buying CPU for your database server that lives in a datacenter and never runs a web browser you will certainly disable these security things.
- computerex 7y ago
  Disabling Spectre/Meltdown mitigations on a server especially would be the dumbest thing imaginable. These attacks are not restricted to JavaScript, they are side-channel attacks and have a huge exploitable surface. Just look at the number of patches for the MS SQL server needed to mitigate: https://support.microsoft.com/en-us/help/4073225/guidance-protect-sql-server-against-spectre-meltdown https://support.microsoft.com/en-us/help/4073225/guidance-pr...
  - reacharavindh 7y ago
    No, it is NOT the dumbest thing imaginable! If your server is not reachable from untrusted sources, and you are running only what you trust, it is prudent to disable mitigation’s and make use of the extra performance. Example, I run many compute nodes (only private network) in my HPC cluster with mitigation’s off. If an attacker could reach the compute nodes over the network to push the attack payload, I’ve already been heavily compromised that these attacks are just insult to the injury. If you run a database server that can never be reached directly by an attacker. You may spend your time watching your application server and let the DB server use the extra oomph.

loeg 7y ago

Appliances might be a better word than applications. If you've got a single privilege level (and that itself isn't a security design flaw), yeah, the info leak isn't a problem. HPCish environments are the obvious example.