28 ms·

There should be some disclosure that it will make it fast but very insecure

taneliv 7y ago
Well, if you have an idea what to do with the undocumented string returned by the site, maybe you also have an idea of what effects it might have, beyond making linux fast again?
- _nalply 7y ago
  If someone suggests something I am not taking it seriously without good explanations.
- thaumasiotes 7y ago
  As mentioned in another comment: https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(again)_on_Intel_CPUs https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(...
  - ainar-g 7y ago
    Important quotes: > You are (probably) an adult. You can and should wisely decide just how much risk you are willing to take. Do or don't try this at home. You do not want to try this at work. > As the above charts show: The effect of default parameters vs mitigations=off is measurable but not hugely impressive. (…)
    - nullc 7y ago
      > You can and should wisely decide just how much risk you are willing to take That requires informed consent. But we can see that people are not well informed: many don't realize that a web broswer or an attacker accessible network stack are attack vectors. I've been using these options for a while (well, mitigations=off is new to me)... on dedicated rendering computers that are on a port isolated network inaccessible to the internet and without the ability to make outgoing connections at all. That's probably (I hope?) a reasonable usecase for these settings... but not exactly a super common one.
Kwantuum 7y ago
there is nospectre_v1 and nospectre_v2 written in there, unless you've been living under a rock you should get a pretty good idea that this is not a very safe thing to do.
- Hackbraten 7y ago
  It depends on your threat model.
  - castis 7y ago
    Could you go into detail on what you mean here?
    - badsectoracula 7y ago
      Are you Jeff Bezos, Bill Gates, Tim Cook or other high profile billionaire or head of state target or work for such a target? If yes, do not do what the site says. If not, it doesn't affect you. Such security measures take into account possibility, but usually ignore probability.
      - wyldfire 7y ago
        > If not, it doesn't affect you. I don't think I agree. Instead, I'd rephrase: "Do you ever use your web browser on this computer to go to less-than-trustworthy sites? Ones that use ad networks or load a cryptominer? Then you may not want to turn these on." The risk for most individuals isn't that they'll be held ransom, rather their property will be abused and they'll have to repair it.
        gjulianm 7y ago
        Are there any live exploits detected for Meltdown or Spectre? When talking about these vulnerabilities people seem to forget that these are pretty costly attacks: complex, slow (iirc at most you can read memory at 5kB/s) and require targeting to specific memory locations/software/etc. Why would an ad network or a cryptominer invest in such an attack when "Click here to download more RAM" still works?
kfrzcode 7y ago
If one uses these flags without understanding exactly what they mean, then one deserves whatever painful experience they may encounter.
- papermachete 7y ago
  What pain, no exploits have ever been documented. These mitigations are makeshift insurance for datacentres.
  - saagarjha 7y ago
    You can download PoCs from GitHub right now.
    - papermachete 7y ago
      I've yet to see reports of one running involuntarily in the wild.
      - saagarjha 7y ago
        Probably because most systems quickly adopted mitigations and attackers then moved back to lower-hanging fruit.
        WanderPanda 7y ago
        So you are saying the anti-vaxxers of the linux world are protected by herd immunity? Interesting angle for sure!
      - pixl97 7y ago
        In March of 2019 there were no world wide pandemics forcing hundreds of millions to shelter in place. The point is you vaccinate before a illness starts spreading if you can, because things spread quickly when you do not and can create quite a mess.
      - 7y ago

Well, if you have an idea what to do with the undocumented string returned by the site, maybe you also have an idea of what effects it might have, beyond making linux fast again?

_nalply 7y ago
If someone suggests something I am not taking it seriously without good explanations.
thaumasiotes 7y ago
As mentioned in another comment: https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(again)_on_Intel_CPUs https://linuxreviews.org/HOWTO_make_Linux_run_blazing_fast_(...
- ainar-g 7y ago
  Important quotes: > You are (probably) an adult. You can and should wisely decide just how much risk you are willing to take. Do or don't try this at home. You do not want to try this at work. > As the above charts show: The effect of default parameters vs mitigations=off is measurable but not hugely impressive. (…)
  - nullc 7y ago
    > You can and should wisely decide just how much risk you are willing to take That requires informed consent. But we can see that people are not well informed: many don't realize that a web broswer or an attacker accessible network stack are attack vectors. I've been using these options for a while (well, mitigations=off is new to me)... on dedicated rendering computers that are on a port isolated network inaccessible to the internet and without the ability to make outgoing connections at all. That's probably (I hope?) a reasonable usecase for these settings... but not exactly a super common one.

Kwantuum 7y ago

there is nospectre_v1 and nospectre_v2 written in there, unless you've been living under a rock you should get a pretty good idea that this is not a very safe thing to do.

Hackbraten 7y ago
It depends on your threat model.
- castis 7y ago
  Could you go into detail on what you mean here?
  - badsectoracula 7y ago
    Are you Jeff Bezos, Bill Gates, Tim Cook or other high profile billionaire or head of state target or work for such a target? If yes, do not do what the site says. If not, it doesn't affect you. Such security measures take into account possibility, but usually ignore probability.
    - wyldfire 7y ago
      > If not, it doesn't affect you. I don't think I agree. Instead, I'd rephrase: "Do you ever use your web browser on this computer to go to less-than-trustworthy sites? Ones that use ad networks or load a cryptominer? Then you may not want to turn these on." The risk for most individuals isn't that they'll be held ransom, rather their property will be abused and they'll have to repair it.
      - gjulianm 7y ago
        Are there any live exploits detected for Meltdown or Spectre? When talking about these vulnerabilities people seem to forget that these are pretty costly attacks: complex, slow (iirc at most you can read memory at 5kB/s) and require targeting to specific memory locations/software/etc. Why would an ad network or a cryptominer invest in such an attack when "Click here to download more RAM" still works?

kfrzcode 7y ago

If one uses these flags without understanding exactly what they mean, then one deserves whatever painful experience they may encounter.

papermachete 7y ago
What pain, no exploits have ever been documented. These mitigations are makeshift insurance for datacentres.
- saagarjha 7y ago
  You can download PoCs from GitHub right now.
  - papermachete 7y ago
    I've yet to see reports of one running involuntarily in the wild.
    - saagarjha 7y ago
      Probably because most systems quickly adopted mitigations and attackers then moved back to lower-hanging fruit.
      - WanderPanda 7y ago
        So you are saying the anti-vaxxers of the linux world are protected by herd immunity? Interesting angle for sure!
    - pixl97 7y ago
      In March of 2019 there were no world wide pandemics forcing hundreds of millions to shelter in place. The point is you vaccinate before a illness starts spreading if you can, because things spread quickly when you do not and can create quite a mess.
    - 7y ago