4 ms·

Think of the average windows user. This person uses Chrome because they got a popup when they went to Gmail. The shortcut for candy crush is still in their star

Think of the average windows user. This person uses Chrome because they got a popup when they went to Gmail. The shortcut for candy crush is still in their start menu because it doesn't bother anything. I am not being insulting -- this is the average, median windows user. This is the person for whom Windows Home is designed. There is ZERO CHANCE that this user knows what a "speculative execution mitigation" is. There is a nonzero chance some cleaner site will tell them to turn it off because it "makes windows faster". They don't understand it can be executed from a website because they don't think of websites as programs because they don't have an icon on the desktop. There is no way this turns out well.

Wowfunhappy 5y ago
Yes, so Microsoft has to make the decision for them. I'm not sure "we're going to make your computer 30% slower because there's a 0.0001% chance someone could steal your password" is the right decision. (These numbers are completely made up. Any decision would depend on getting the right numbers, but this appears to be easier said than done. I've seen very different estimates.)
- freeone3000 5y ago
  An unpatched data exfil against the OS with the largest install base in the world? It doesn't matter it's a byte at a time, cryptominers have done more with less. The question isn't if, the question is who and how many. The fallout from SMB2 is still ongoing, and it was patched 10 years ago. The idea of not patching EVER opens up harms for the next twenty years for everyone.
  - cookiengineer 5y ago
    > The fallout from SMB2 This made me wanna cry. Jokes aside, there's much truth to this. Attack vectors at this scale are seriously dangerous. I'm still hoping we can prevent the namewreck fallout of SCADA systems, because at one point or another, 8200 is gonna make a mistake with their offensive cybersec operations.
- michaelmrose 5y ago
  What is the chance that this user has unbacked up data that someone could extort them for $500. Multiply this chance by the proportion who would enable a "go faster" option and then by 1.5 billion computers. Let us say 20% and 25% * 1.5B. Maybe 75M targets give or take depending on how you want to do the math.

Wowfunhappy 5y ago

Yes, so Microsoft has to make the decision for them. I'm not sure "we're going to make your computer 30% slower because there's a 0.0001% chance someone could steal your password" is the right decision. (These numbers are completely made up. Any decision would depend on getting the right numbers, but this appears to be easier said than done. I've seen very different estimates.)

freeone3000 5y ago
An unpatched data exfil against the OS with the largest install base in the world? It doesn't matter it's a byte at a time, cryptominers have done more with less. The question isn't if, the question is who and how many. The fallout from SMB2 is still ongoing, and it was patched 10 years ago. The idea of not patching EVER opens up harms for the next twenty years for everyone.
- cookiengineer 5y ago
  > The fallout from SMB2 This made me wanna cry. Jokes aside, there's much truth to this. Attack vectors at this scale are seriously dangerous. I'm still hoping we can prevent the namewreck fallout of SCADA systems, because at one point or another, 8200 is gonna make a mistake with their offensive cybersec operations.
michaelmrose 5y ago
What is the chance that this user has unbacked up data that someone could extort them for $500. Multiply this chance by the proportion who would enable a "go faster" option and then by 1.5 billion computers. Let us say 20% and 25% * 1.5B. Maybe 75M targets give or take depending on how you want to do the math.