5 ms·
For some reason, I doubt people in the server/workstation space don't know how to do this, especially if they are leaving double digit percentage gains on the t
by stagger87 7y ago
For some reason, I doubt people in the server/workstation space don't know how to do this, especially if they are leaving double digit percentage gains on the table if they don't.
- computerex 7y agoYou are not supposed to disable the mitigations... Especially on servers and workstations... And keep in mind that the usual mitigations aren't even holistic. The only truly 100% secure fix for Spectre/Meltdown is to disable hyperthreading altogether.
- lonelappde 7y agoNo. Spectre does not depend on hyperthreading, only speculative execution.
- computerex 7y agoI was lumping them all into MDS class of vulnerabilities. It was misleading. https://linuxreviews.org/Microarchitectural_Data_Sampling:_The_Latest_Side-Channel_Vulnerability_In_Intel_CPUs#Full_protection_requires_SMT.2FHyperThreading_to_be_disabled https://linuxreviews.org/Microarchitectural_Data_Sampling:_T...
- pmoriarty 7y agoWhy shouldn't you disable them on servers that don't run Javascript or any other untrusted code?
- icedchai 7y agoFor servers that aren't running arbitrary third party code, like PaaS or IaaS, why not?
- roblabla 7y agoIf your server is running baremetal, no problem. If it's running on a shared hosting environment, a co-tenant VM can exfiltrate your data. See L1TF/Foreshadow.
- icedchai 7y agoHaven't all the big cloud providers have patched their hypervisors for that?
- computerex 7y agoYou really want to rely on such assumptions for security?
- icedchai 7y agoIt doesn’t keep me up at night.