Guy who worked closer to the metal in a previous life but sadly moved to web development 13 years ago and who is now looking to exit the area and return to hard

Guy who worked closer to the metal in a previous life but sadly moved to web development 13 years ago and who is now looking to exit the area and return to hardcore backend, sysadmin and general system scripting roles here, giving his uninformed (in the details) take: (TL;DR) Yes there are real risks in disabling the mitigations like I did but the combined chances of actually being targeted _and_ duped into installing something that greatly accelerates the pace with which my stuff can be exfiltrated, are minuscule. People love to talk about the "risk of event $A" but what's very often missed in these discussions that for an attacker to get exactly what they want from you they need the risk of several, if not many, events -- say, $A to $Z -- to be high at the same time which as we all know from math reduces the resulting probability severely (due to multiplication of several numbers and they are all less than 1.0). (/TL;DR) Several months ago I disabled all the mitigations on my home Linux server, and I plan to disable them on two laptops I'll install Linux on as well. The server is headless so the attack surface is drastically reduced (unless the package manager gets frisky with executing semi-random Python/JS scripts in pre/post installation phases). The laptops are riskier, and we know how insecure X11 is in general; it's a free for all game once a malicious program gets installed. To me the lost performance actually hurts. I have the before and after experience. I made a quick and small analysis of my risks. My router is reasonably secure and I've done some elementary homework e.g. VLANs to isolate the gaming machines, guest smartphones and other risky devices from the rest of our home's trusted devices, allow-list mine / my wife's / few friends' devices and disallow outgoing traffic for everything else. I am comfortable with my risk-to-reward ratio involved in disabling the mitigations. I get all the reservations (and I would love to return to working closer to the metal one day, too). I am aware that 219 bytes/sec is plenty enough for a persistent worm-like software to eventually exfiltrate everything* it needs. I am 100% sure it can be done. However: - It requires significant time and effort on the part of the attacker. They have resources, I know, but they very likely don't have foolproof exploits ready even for the original Spectre/Meltdown exploits. They require several layers of things going wrong on my machine for them to succeed. And I block most of the JS on the sites I visit. Chance is still bigger than 0% but IMO not enough to get scared. - It requires them to iterate on the said worm/virus many times because in no universe does any adversary have perfect programmers that create the perfect exfiltration software on the first try. Thus, them being able to auto-update the software on my machines is not a given because they get periodically updated and rebooted which might deprive them of the vector they used to get in (which might be ephemeral and stored only in memory or temporary files). Every several months I proactively upgrade the kernel which is yet another way for them to lose their way in. - It requires several* things to go wrong for me at the same time, for this particular exploit. Not very likely I think. I am not excellent with security but I generally wouldn't jump through hoops to install some obscure program that might be infected (whether the Linux distro package repos are already infiltrated and are serving the three-letter agencies is a scary question but one worth asking; still, nothing I can do about that. I won't stop using Linux). --- All in all, meh. If you are targeted by nation states or their contractors you have much worse things to worry about e.g. whether somebody in the Costa Rican cafe you work on your laptop that month from will call the police on you. If you are a high-profile target you wouldn't sit on your arse waiting to be hacked, too. You will not have static IPs and your machines will likely get periodically scrubbed, too. That's what I would do and I am a complete amateur. I am pretty sure the people who are actually pursued know much better than me. So to me these articles are extremely interesting from the point of a view of a security researcher but an almost complete non-danger for most folk out there.