5 ms·
You are not supposed to disable the mitigations... Especially on servers and workstations... And keep in mind that the usual mitigations aren't even holistic. T
by computerex 7y ago
You are not supposed to disable the mitigations... Especially on servers and workstations... And keep in mind that the usual mitigations aren't even holistic. The only truly 100% secure fix for Spectre/Meltdown is to disable hyperthreading altogether.
- lonelappde 7y agoNo. Spectre does not depend on hyperthreading, only speculative execution.
- computerex 7y agoI was lumping them all into MDS class of vulnerabilities. It was misleading. https://linuxreviews.org/Microarchitectural_Data_Sampling:_The_Latest_Side-Channel_Vulnerability_In_Intel_CPUs#Full_protection_requires_SMT.2FHyperThreading_to_be_disabled https://linuxreviews.org/Microarchitectural_Data_Sampling:_T...
- pmoriarty 7y agoWhy shouldn't you disable them on servers that don't run Javascript or any other untrusted code?
- icedchai 7y agoFor servers that aren't running arbitrary third party code, like PaaS or IaaS, why not?
- roblabla 7y agoIf your server is running baremetal, no problem. If it's running on a shared hosting environment, a co-tenant VM can exfiltrate your data. See L1TF/Foreshadow.
- icedchai 7y agoHaven't all the big cloud providers have patched their hypervisors for that?
- computerex 7y agoYou really want to rely on such assumptions for security?
- icedchai 7y agoIt doesn’t keep me up at night.