2 ms·
I turned them all off on all my production servers they don't run arbitrary untrusted code and send a LOT of packets, those mitigations really hurt
by blibble 5y ago
I turned them all off on all my production servers
they don't run arbitrary untrusted code and send a LOT of packets, those mitigations really hurt
- staticassertion 5y agoI think that's the smart thing to do. Default to safe, let people evaluate their threat model and disable as needed. I'm curious, what options did you disable?
- secondcoming 5y agoAdd 'mitigations=off' to the kernel command line (assuming you're using linux) We did it for most of our GCP images
- TillE 5y agoRight, I'm not sure Spectre is worth worrying about outside of big multi-user systems, or a web browser executing Javascript. Otherwise if you're executing untrusted code, you're in big trouble regardless.
- landemva 5y agoThat works on bare metal you control. If you rent something with VM / hypervisor the mitigations are important to protect from other VMs on the machine.
- waych 5y agoMitigation between VMs is only effective when done from the hypervisor. Mitigations within a VM can only counter intra VM data leaks.