4 ms·
mitigations=off in the grub kernel options. You don't need mitigations if you're a server where you control every single running service and application. You
by Sunspark 4y ago
mitigations=off in the grub kernel options.
You don't need mitigations if you're a server where you control every single running service and application.
You don't need mitigations if you're a HN reader. Do you click on everything randomly and say "yes" to every prompt that pops open?
- suid 4y agoWhile I mostly agree with that assertion (we do run with mitigations off in our small dedicated devices), there is an important caveat: this only applies if you're 100% positive that you control everything that runs on your box. If you have _any_ sort of vulnerability in anything that runs on your box and talks to the outside world, that allows for execution of attacker-injected code (even running unprivileged), you're now vulnerable to these speculative execution attacks. You have to decide how much of a risk you're willing to take in this regard.