4 ms·
The default Garuda GRUB options disable all CPU/GPU level security patches against Meltdown, Spectre etc. by running with "mitigations=off". That is playing wit
by stragies 6y ago
The default Garuda GRUB options disable all CPU/GPU level security patches against Meltdown, Spectre etc. by running with "mitigations=off". That is playing with fire for anything operating on data you'd consider non-public, imo.
- LargoLasskhyfv 6y agoI noticed that, and said so in another post... edit: Think of cars on a racetrack. Street worthiness considered ballast...ROAAARRRR!
- Saint_Genet 6y agoA ddg site search of "cve" returns zero hits.
- VRay 6y agoI don't get it, are you saying spectre/meltdown aren't dangerous?
- screamingninja 6y agohttps://nvd.nist.gov/vuln/detail/CVE-2017-5715 https://nvd.nist.gov/vuln/detail/CVE-2017-5715 https://nvd.nist.gov/vuln/detail/CVE-2017-5754 https://nvd.nist.gov/vuln/detail/CVE-2017-5754 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 https://nvd.nist.gov/vuln/detail/CVE-2018-3639 > A ddg site search of "cve" returns zero hits. What was your search query?
- Saint_Genet 6y agoI think I expressed myself poorly, a search of the Garuda site has zero hits on the term cve.
- jonathonf 6y agoThere is an _option_ to do this, it is _not_ the default.
- stragies 6y agoThe screenshot in their picture gallery has it checked, so I assumed, that was the default setting
- jonathonf 6y agoI guess the Garuda Boot Options screenshot shows the options in operation: https://garudalinux.org/images/garuda/ss/garuda-boot-options.png https://garudalinux.org/images/garuda/ss/garuda-boot-options... I'm not sure whether this is misleading or not given the nature of illustrative screenshots, e.g. the package management one shows VLC installed but not Firefox: https://garudalinux.org/images/garuda/ss/pamac.png https://garudalinux.org/images/garuda/ss/pamac.png
- rndgermandude 6y agoIs it really so much worse, outright playing with fire? There are only few things running untrusted code on a typical end-user system, most notably the browsers executing javascript. Now that would be attack-able. But then again, it seems unlikely that anybody would launch broadly deployed attacks, as the vast majority of systems would run with mitigations on, so it's just not worth the trouble considering that and considering that you also have to get lucky to actually extract something valuable (and recognize it is valuable). On top of that, browsers also bring a bunch of mitigations that make it harder to exploit these bugs even if system mitigations are disabled. I'm personally not very concerned about anybody trying to attack me with spectre/meltdown class bugs that can be and are usually mitigated, even with mitigations disabled on my system. If somebody wanted to attack me, either at random (broad attack), or targeting me specifically, they'd have far better ways and targets to try first than hoping I'd visit their website and run without mitigations enabled and have something valuable in my memory. This is different if it's a shared system, like cloud machines/shared hosting, where this is an class of bugs is far more of a concern. And if you know or have reason to suspect you're a specific target, then you might err on the side of caution as well.
- acct776 6y agoThis is an outdated take. These attacks are being done algorithmically, automatically now.
- rndgermandude 6y ago{citation needed} Seriously, I haven't seen any news of these attacks being used against end-user systems, either broadly or targeted. Have some links?