4 ms·

If I disable these fixes, how likely (how much effort?) it is that somebody would make use of these vulnerabilities? AFAIK, I (my personal workstation) would o

If I disable these fixes, how likely (how much effort?) it is that somebody would make use of these vulnerabilities? AFAIK, I (my personal workstation) would only be exposed via browser JS so if I do not spend too much time on shady sites, I should be good?

papermachete 7y ago
Yes, a lot of these mitigations have demoscene on github so you can run an exploit locally.
saagarjha 7y ago
There are ready-made Spectre exploits that will attack your browser if it hasn’t been hardened yet; these kinds of exploits are fairly straightforward. Spectre v2 is harder to pull off, but can reach across processes and so you’re presumably vulnerable to that.
kstenerud 7y ago
Basically: If you're fine with every program running on the system (including web browser in your case) having full, unfettered access to everything else on the system, then it's fine to disable the fixes. In other words: Only do this on systems where you actually trust each running program not to be compromised in its day-to-day operations and turn against you. Anything that runs arbitrary code from an outside source (for example JS) is not safe.
- tasubotadas 7y ago
  I trust all of my programs as I use either only open-source or "big-player" packages. The only problem would seem to be JS from shady websites. I guess now the question is, how much time to I have to spend on that site before it can get my private ssh keys?
  - spockz 7y ago
    The JavaScript of shady adverts that sometimes pop through can also occur on no. Shady websites. So you are not entirely safe by only browsing safe sites.
    - CamperBob2 7y ago
      That doesn't answer the question, of course; it's just a sales pitch for the proverbial tiger-proof rock. To reiterate: how long does s/he have to spend on a shady site before a successful SPECTRE exploit takes place? If this were actually happening in the real world, maybe we'd know. But it's not, so we don't, and life goes on. Albeit slowly.
- CamperBob2 7y ago
  And yet, with all of the pearl-clutching in this thread and countless others just like it, nobody seems to be able to point to any real-world exploits. The threat is purely theoretical. The loss in performance is not.
- tsimionescu 7y ago
  > having full, unfettered access to everything else on the system, then it's fine to disable the fixes. You should say READ access. There is no risk of write access with Spectre or Meltdown.
- jcranmer 7y ago
  As tsimionescu points out, it's only read access. But to go further, in most Unix systems, the default is already to give most users read access to almost everything: default masks in the filesystem tend to be 755, and when it comes to inspecting data from other users, there's an awful lot you can figure out by default. Leaving aside the fact that many home computers are single-user in practice anyways.
hoistbypetard 7y ago
Do you trust the sites you visit not to be compromised by shady ad networks, shady individuals, etc.?

papermachete 7y ago

Yes, a lot of these mitigations have demoscene on github so you can run an exploit locally.

saagarjha 7y ago

There are ready-made Spectre exploits that will attack your browser if it hasn’t been hardened yet; these kinds of exploits are fairly straightforward. Spectre v2 is harder to pull off, but can reach across processes and so you’re presumably vulnerable to that.

kstenerud 7y ago

Basically: If you're fine with every program running on the system (including web browser in your case) having full, unfettered access to everything else on the system, then it's fine to disable the fixes. In other words: Only do this on systems where you actually trust each running program not to be compromised in its day-to-day operations and turn against you. Anything that runs arbitrary code from an outside source (for example JS) is not safe.

tasubotadas 7y ago
I trust all of my programs as I use either only open-source or "big-player" packages. The only problem would seem to be JS from shady websites. I guess now the question is, how much time to I have to spend on that site before it can get my private ssh keys?
- spockz 7y ago
  The JavaScript of shady adverts that sometimes pop through can also occur on no. Shady websites. So you are not entirely safe by only browsing safe sites.
  - CamperBob2 7y ago
    That doesn't answer the question, of course; it's just a sales pitch for the proverbial tiger-proof rock. To reiterate: how long does s/he have to spend on a shady site before a successful SPECTRE exploit takes place? If this were actually happening in the real world, maybe we'd know. But it's not, so we don't, and life goes on. Albeit slowly.
CamperBob2 7y ago
And yet, with all of the pearl-clutching in this thread and countless others just like it, nobody seems to be able to point to any real-world exploits. The threat is purely theoretical. The loss in performance is not.
tsimionescu 7y ago
> having full, unfettered access to everything else on the system, then it's fine to disable the fixes. You should say READ access. There is no risk of write access with Spectre or Meltdown.
jcranmer 7y ago
As tsimionescu points out, it's only read access. But to go further, in most Unix systems, the default is already to give most users read access to almost everything: default masks in the filesystem tend to be 755, and when it comes to inspecting data from other users, there's an awful lot you can figure out by default. Leaving aside the fact that many home computers are single-user in practice anyways.

hoistbypetard 7y ago

Do you trust the sites you visit not to be compromised by shady ad networks, shady individuals, etc.?