4 ms·
If one uses these flags without understanding exactly what they mean, then one deserves whatever painful experience they may encounter.
by kfrzcode 6y ago
If one uses these flags without understanding exactly what they mean, then one deserves whatever painful experience they may encounter.
- papermachete 6y agoWhat pain, no exploits have ever been documented. These mitigations are makeshift insurance for datacentres.
- saagarjha 6y agoYou can download PoCs from GitHub right now.
- papermachete 6y agoI've yet to see reports of one running involuntarily in the wild.
- saagarjha 6y agoProbably because most systems quickly adopted mitigations and attackers then moved back to lower-hanging fruit.
- WanderPanda 6y agoSo you are saying the anti-vaxxers of the linux world are protected by herd immunity? Interesting angle for sure!
- pixl97 6y agoIn March of 2019 there were no world wide pandemics forcing hundreds of millions to shelter in place. The point is you vaccinate before a illness starts spreading if you can, because things spread quickly when you do not and can create quite a mess.
- untog 6y ago"I've yet to see a horse run out, so why would I bolt this barn door?"
- papermachete 6y agoIt's a special type of horse that won't run out unless aliens from another galaxy throw space hay at the door.
- jbjohns 6y agoI'm truly shocked by the comments I'm seeing here. When did so many people forget everything we've learned about security? You know what a zero-day attack is right? You know how fast those can cover the whole internet these days right? So why would you purposely leave a gaping security hole in your system to get some performance on a CPU that's probably too fast for your realistic workload already?
- kfrzcode 6y agoI've never seen reports indicating any exploit running involuntarily in the wild, ever. That fact, however, does not validate my position.
- icedchai 6y agoThese academic PoCs read data that they themselves have staged during execution. This is very different from reading arbitrary, random memory that contains something like a cookie for another web site, password, or SSH key. When someone is looking for a real world exploit, this is what they want.
- saagarjha 6y agoI don't think anyone has actually bothered to a microarchitectural side channel in practice yet.
- kfrzcode 6y agoThe operative word in my sentence is "may," indicating a level of uncertainty.