5 ms·

I got as far as "HyperThreading is insecure so disable it". There are some absurd recommendations on here (disable TCP SACK, use TCP BBR) and the weirdest of a

I got as far as "HyperThreading is insecure so disable it". There are some absurd recommendations on here (disable TCP SACK, use TCP BBR) and the weirdest of all is why anyone who hates FreeBSD security this much would still use the OS?

acoppora 4y ago
Unfortunately Intel sold us all a very dangerous technology that we got used to. Hyperthreading has been disabled in more security-conscious OSes like OpenBSD and HardenedBSD. Greg KH praised OpenBSD for making this decision, even if he couldn't for Linux.
- Sunspark 4y ago
  Ironically, imo for servers it would make sense to leave hyperthreading turned on because a server has full control over what is installed and what is running.
mananaysiempre 4y ago
I mean, Greg Kroah-Hartman of Linux agrees[1,2] as far as Spectre etc. go; more generally there seems to be almost no microarchitectural isolation between HT threads on x86 implementations, so the leaks probably won’t ever really cease there. The performance benefits of HT are also not at all universal. I mean, they do exist in some cases—if you’re running closely related scalar-compute- (or, better, dependency-) bound tasks that bang on the same small piece of memory, or if you run several things that are just bad at loading the CPU so HT-induced contention doesn’t matter. (The latter scenario was obviously much more important at the time HT was introduced, when neither people nor compilers were particularly good at optimizing for superscalars.) Or, though it’s not a performance benefit, it can help if you have few cores and the OS scheduler is bad at letting interactive tasks run in the presence of long-running batch ones or heavy swapping. But properly optimized multithreaded data crunching like video coding or compression doesn’t really run faster when given extra threads to run on HT “cores” rather than just leaving them disabled or idle. [1] https://www.youtube.com/watch?v=jI3YE3Jlgw8 https://www.youtube.com/watch?v=jI3YE3Jlgw8 [2] https://news.ycombinator.com/item?id=20865492 https://news.ycombinator.com/item?id=20865492
- sph 4y ago
  Would it make sense to mitigations and hyperthreading on a workstation? Perhaps we're getting to a point that both disabled is faster than both enabled (and suffering from the mitigations penalties)
  - sillystuff 4y ago
    This is interesting. The mitigations have had a major impact. Especially with the recent loss of reptoline[1] on older AMD/Intel. Maybe enough that there isn't an advantage anymore to enable SMT on some processor families? At an old job, we disabled SMT on our hypervisor hosts in an effort to mitigate some of the security issues before patches were available. We had to roll back. Without SMT, the hosts struggled to keep up with load. If I had to quantify it, I'd estimate that we lost, at least, 30% performance by disabling SMT (probably more). Those servers were replaced before I left, but I'd be interested to compare disabled SMT to enabled SMT with all the current mitigations in place. [1] https://www.makeuseof.com/new-spectre-vulnerabilities-amd-intel-chips/ https://www.makeuseof.com/new-spectre-vulnerabilities-amd-in...
rsync 4y ago
I have been using fbsd almost exclusively, professionally, for 25 years - and built somewhat high profile projects (Johncompanies, rsync.net) on top of it and … there is plenty of hate in my love/hate relationship with it. It doesn’t seem odd to me at all that this individual would continue to use freebsd while maintaining such strongly held critiques of it.
- suprjami 4y ago
  If I hated something that badly or had such security concerns about it, I'd drop it like a hot potato for a superior alternative. I just don't have time for that level of irritation or worry in my life.
  - nix23 4y ago
    Ahhh another OpenVMS user!! Hello buddy!!

acoppora 4y ago

Unfortunately Intel sold us all a very dangerous technology that we got used to. Hyperthreading has been disabled in more security-conscious OSes like OpenBSD and HardenedBSD. Greg KH praised OpenBSD for making this decision, even if he couldn't for Linux.

Sunspark 4y ago
Ironically, imo for servers it would make sense to leave hyperthreading turned on because a server has full control over what is installed and what is running.

mananaysiempre 4y ago

I mean, Greg Kroah-Hartman of Linux agrees[1,2] as far as Spectre etc. go; more generally there seems to be almost no microarchitectural isolation between HT threads on x86 implementations, so the leaks probably won’t ever really cease there. The performance benefits of HT are also not at all universal. I mean, they do exist in some cases—if you’re running closely related scalar-compute- (or, better, dependency-) bound tasks that bang on the same small piece of memory, or if you run several things that are just bad at loading the CPU so HT-induced contention doesn’t matter. (The latter scenario was obviously much more important at the time HT was introduced, when neither people nor compilers were particularly good at optimizing for superscalars.) Or, though it’s not a performance benefit, it can help if you have few cores and the OS scheduler is bad at letting interactive tasks run in the presence of long-running batch ones or heavy swapping. But properly optimized multithreaded data crunching like video coding or compression doesn’t really run faster when given extra threads to run on HT “cores” rather than just leaving them disabled or idle. [1] https://www.youtube.com/watch?v=jI3YE3Jlgw8 https://www.youtube.com/watch?v=jI3YE3Jlgw8 [2] https://news.ycombinator.com/item?id=20865492 https://news.ycombinator.com/item?id=20865492

sph 4y ago
Would it make sense to mitigations and hyperthreading on a workstation? Perhaps we're getting to a point that both disabled is faster than both enabled (and suffering from the mitigations penalties)
- sillystuff 4y ago
  This is interesting. The mitigations have had a major impact. Especially with the recent loss of reptoline[1] on older AMD/Intel. Maybe enough that there isn't an advantage anymore to enable SMT on some processor families? At an old job, we disabled SMT on our hypervisor hosts in an effort to mitigate some of the security issues before patches were available. We had to roll back. Without SMT, the hosts struggled to keep up with load. If I had to quantify it, I'd estimate that we lost, at least, 30% performance by disabling SMT (probably more). Those servers were replaced before I left, but I'd be interested to compare disabled SMT to enabled SMT with all the current mitigations in place. [1] https://www.makeuseof.com/new-spectre-vulnerabilities-amd-intel-chips/ https://www.makeuseof.com/new-spectre-vulnerabilities-amd-in...

rsync 4y ago

I have been using fbsd almost exclusively, professionally, for 25 years - and built somewhat high profile projects (Johncompanies, rsync.net) on top of it and … there is plenty of hate in my love/hate relationship with it. It doesn’t seem odd to me at all that this individual would continue to use freebsd while maintaining such strongly held critiques of it.

suprjami 4y ago
If I hated something that badly or had such security concerns about it, I'd drop it like a hot potato for a superior alternative. I just don't have time for that level of irritation or worry in my life.
- nix23 4y ago
  Ahhh another OpenVMS user!! Hello buddy!!