4 ms·

I've given up tracking this stuff. Just been adding https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ to my grub configs everwhere.

by esaym 6y ago

edoceo 6y ago
Please, not in production systems
- deleted 6y ago
  [deleted]
- latch 6y ago
  Why not? Or do you mean "please, not in a production system where you share a host"? If that's the case, I think you have it backwards. In production, please, don't share a host.
- numpad0 6y ago
  There’s zero reason to change 8 digit passwords every 6 months if your /etc/passwd isn’t insecure
teddyh 6y ago
Even if you are OK with using that on a machine, that list of options absolutely reeks of magical thinking. On a modern Linux, a simple "mitigations=off" is equivalent to more than half of the other options listed, and many of the remaining listed options don't seem to exist anymore.
- colejohnson66 6y ago
  Like how some people still advocate for wiping hard drives with the Gutmann method (35 wipe passes)[0] when a single pass is more than sufficient for practically everyone?[a][b] [a]: Obviously, for absolute security, a hammer and/or a shredder does much better. [b]: This also ignores that the Gutmann method was designed for hard drive encoding methods that aren’t used anymore. [0]: https://en.wikipedia.org/wiki/Gutmann_method https://en.wikipedia.org/wiki/Gutmann_method
  - SAI_Peregrinus 6y ago
    Method A is also known as "Widlarizing" or the "Widlar" method. "How do you Widlarize something? You take it over to the anvil part of the vice and you beat on it with a hammer, until it is all crunched down into tiny little pieces, so small that you don't even have to sweep it off the floor. It sure makes you feel better. And you know that component will never vex you again." Bob Pease, describing Bob Widlar's method for dealing with broken electronic components.
  - jankotek 6y ago
    > [a]: Obviously, for absolute security, a hammer and/or a shredder does much better. This still leaves large pieces of magnetic plates intact. At uni we could read some data from floppies that went through shredder. Hammer and shredder is NOT "absolute security".
    - morsch 6y ago
      1.44 MB 3.5in floppies had 17434 bpi. Hard disks apparantly have around 1 Tbpi. That's like saying it's possible to jump to the moon because you could do a slam dunk back in school. You're probably still right, though. https://www.anandtech.com/show/11925/western-digital-stuns-storage-industry-with-mamr-breakthrough-for-nextgen-hdds/2 https://www.anandtech.com/show/11925/western-digital-stuns-s... https://en.m.wikipedia.org/wiki/Disk_density https://en.m.wikipedia.org/wiki/Disk_density
- mnarayan01 6y ago
  Unfortunately e.g. the RHEL 7 world doesn't have mitigations=off yet (in addition to many other kernel command line sugars).
- weare138 6y ago
  It's intended to be a catch all for multiple kernel versions. The 'mitigations=off' option was introduced with version 5.2. https://www.phoronix.com/scan.php?page=news_item&px=Spectre-Meltdown-Easy-Switch-52 https://www.phoronix.com/scan.php?page=news_item&px=Spectre-...
  - teddyh 6y ago
    I would much rather have liked to see a list of kernel versions with customized options for each. I mean, imagine coming upon a system where you want to add some other kernel option. You see that the system has all those options already added to the default kernel options. Are you going to research and clean up those options and remove the irrelevant ones? Or are you going to punt, add your own option to the end, thereby adding to the chaos?
- jcelerier 6y ago
  I'm the author of the website - I keep the whole list because older kernels didn't have mitigation=off, and inexisting options won't prevent your system from booting.
fogihujy 6y ago
Related: does anyone know how good current browsers are at mitigating Spectre-related attacks through JavaScript? It's hard to run a browser on the modern Internet without at least running _some_ untrusted JS. Turning off the mitigations in the kernel sure speeds things up a lot on older machines, but if browsers don't do a proper job of mitigating those attacks then someone could extract data through JavaScript.

I've given up tracking this stuff. Just been adding https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ to my grub configs everwhere.

by esaym 6y ago

I've given up tracking this stuff. Just been adding https://make-linux-fast-again.com/ https://make-linux-fast-again.com/ to my grub configs everwhere.

edoceo 6y ago

Please, not in production systems

deleted 6y ago
[deleted]
latch 6y ago
Why not? Or do you mean "please, not in a production system where you share a host"? If that's the case, I think you have it backwards. In production, please, don't share a host.
numpad0 6y ago
There’s zero reason to change 8 digit passwords every 6 months if your /etc/passwd isn’t insecure

teddyh 6y ago

Even if you are OK with using that on a machine, that list of options absolutely reeks of magical thinking. On a modern Linux, a simple "mitigations=off" is equivalent to more than half of the other options listed, and many of the remaining listed options don't seem to exist anymore.

colejohnson66 6y ago
Like how some people still advocate for wiping hard drives with the Gutmann method (35 wipe passes)[0] when a single pass is more than sufficient for practically everyone?[a][b] [a]: Obviously, for absolute security, a hammer and/or a shredder does much better. [b]: This also ignores that the Gutmann method was designed for hard drive encoding methods that aren’t used anymore. [0]: https://en.wikipedia.org/wiki/Gutmann_method https://en.wikipedia.org/wiki/Gutmann_method
- SAI_Peregrinus 6y ago
  Method A is also known as "Widlarizing" or the "Widlar" method. "How do you Widlarize something? You take it over to the anvil part of the vice and you beat on it with a hammer, until it is all crunched down into tiny little pieces, so small that you don't even have to sweep it off the floor. It sure makes you feel better. And you know that component will never vex you again." Bob Pease, describing Bob Widlar's method for dealing with broken electronic components.
- jankotek 6y ago
  > [a]: Obviously, for absolute security, a hammer and/or a shredder does much better. This still leaves large pieces of magnetic plates intact. At uni we could read some data from floppies that went through shredder. Hammer and shredder is NOT "absolute security".
  - morsch 6y ago
    1.44 MB 3.5in floppies had 17434 bpi. Hard disks apparantly have around 1 Tbpi. That's like saying it's possible to jump to the moon because you could do a slam dunk back in school. You're probably still right, though. https://www.anandtech.com/show/11925/western-digital-stuns-storage-industry-with-mamr-breakthrough-for-nextgen-hdds/2 https://www.anandtech.com/show/11925/western-digital-stuns-s... https://en.m.wikipedia.org/wiki/Disk_density https://en.m.wikipedia.org/wiki/Disk_density
mnarayan01 6y ago
Unfortunately e.g. the RHEL 7 world doesn't have mitigations=off yet (in addition to many other kernel command line sugars).
weare138 6y ago
It's intended to be a catch all for multiple kernel versions. The 'mitigations=off' option was introduced with version 5.2. https://www.phoronix.com/scan.php?page=news_item&px=Spectre-Meltdown-Easy-Switch-52 https://www.phoronix.com/scan.php?page=news_item&px=Spectre-...
- teddyh 6y ago
  I would much rather have liked to see a list of kernel versions with customized options for each. I mean, imagine coming upon a system where you want to add some other kernel option. You see that the system has all those options already added to the default kernel options. Are you going to research and clean up those options and remove the irrelevant ones? Or are you going to punt, add your own option to the end, thereby adding to the chaos?
jcelerier 6y ago
I'm the author of the website - I keep the whole list because older kernels didn't have mitigation=off, and inexisting options won't prevent your system from booting.

fogihujy 6y ago

Related: does anyone know how good current browsers are at mitigating Spectre-related attacks through JavaScript? It's hard to run a browser on the modern Internet without at least running _some_ untrusted JS. Turning off the mitigations in the kernel sure speeds things up a lot on older machines, but if browsers don't do a proper job of mitigating those attacks then someone could extract data through JavaScript.