4 ms·

This week I've been "rejuvenating" my 11 year old i7 2600k desktop. I built a zen 3 based computer a couple years ago, purely as a luxury, after spending 5 days

This week I've been "rejuvenating" my 11 year old i7 2600k desktop. I built a zen 3 based computer a couple years ago, purely as a luxury, after spending 5 days in the hospital ICU. The i7 was chugging along just fine doing whatever I needed it to do, and it seemed a waste to just forget about it. I fully disassembled it and cleaned out the dust. I spent an evening lapping the CPU and heat sink down to 2000 grit. I put it in a new case, as the old one's front panel fell off. I installed my old GTX 970 GPU, which seems like a perfect pairing. Maybe I'll gift it to a young nephew, or maybe I'll set it to easily boot up into a mentally stimulating game for my 4 year old daughter. Her knowledge of computer games right now is beamng.drive and tux racer!

serf 4y ago
The worst part isn't that the old hardware isn't worthwhile; it's that it has to be hobbled so much in order to be secure on todays' net. Things like Spectre created a lot of additional obsolescence.
- Sunspark 4y ago
  I think you can still be secure on the net with the Spectre and Meltdown mitigations disabled on a personal system. If your browser is current, it already has mitigations built into it. Are there any mathematical calculations showing the risk % of disabling mitigations? Or is this just herd activity where everyone sets it as a default because they don't want to accept the liability for the remote chance of lightning striking?
  - dijit 4y ago
    This is dangerous, and maybe not in the way you expect. Personal systems are running a lot more untrusted code than, for example, servers. Mitigations are more necessary on personal computers than on servers. As for "it's mitigated in the browser", the issue is that there's no "one" mitigation for anything, you have to mitigate it on the OS, in the browser, in the microcode for the CPU. Everything. You can't just apply one mitigation and be done. FWIW the "mitigation" in browsers was to disable high precision timers; which seems to be making its way back, and was never necessary, it just made the exploit easier. I highly recommend keeping mitigations enabled for personal machines; when it comes to servers with a decent WAF that are not shared amongst users that can run code: disabling mitigations makes more sense. (dedicated databases, for example). Someone described the mitigations as: "Surrounding a drunk person with trampolines in the hope that when they collapse they will be corrected into the right position", I think this is the most apt example I can think of. For personal systems that run a lot of untrusted code (due mostly to the web): I wouldn't personally advocate for removing a trampoline.
deleted 4y ago
[deleted]

serf 4y ago

The worst part isn't that the old hardware isn't worthwhile; it's that it has to be hobbled so much in order to be secure on todays' net. Things like Spectre created a lot of additional obsolescence.

Sunspark 4y ago
I think you can still be secure on the net with the Spectre and Meltdown mitigations disabled on a personal system. If your browser is current, it already has mitigations built into it. Are there any mathematical calculations showing the risk % of disabling mitigations? Or is this just herd activity where everyone sets it as a default because they don't want to accept the liability for the remote chance of lightning striking?
- dijit 4y ago
  This is dangerous, and maybe not in the way you expect. Personal systems are running a lot more untrusted code than, for example, servers. Mitigations are more necessary on personal computers than on servers. As for "it's mitigated in the browser", the issue is that there's no "one" mitigation for anything, you have to mitigate it on the OS, in the browser, in the microcode for the CPU. Everything. You can't just apply one mitigation and be done. FWIW the "mitigation" in browsers was to disable high precision timers; which seems to be making its way back, and was never necessary, it just made the exploit easier. I highly recommend keeping mitigations enabled for personal machines; when it comes to servers with a decent WAF that are not shared amongst users that can run code: disabling mitigations makes more sense. (dedicated databases, for example). Someone described the mitigations as: "Surrounding a drunk person with trampolines in the hope that when they collapse they will be corrected into the right position", I think this is the most apt example I can think of. For personal systems that run a lot of untrusted code (due mostly to the web): I wouldn't personally advocate for removing a trampoline.

deleted 4y ago

[deleted]