3 ms·
> You should make sure your system receives microcode updates to get fixes and mitigations for CPU vulnerabilities like Meltdown and Spectre. These cause a 10%
by GartzenDeHaes 3y ago
> You should make sure your system receives microcode updates to get fixes and mitigations for CPU vulnerabilities like Meltdown and Spectre.
These cause a 10%-20% performance drop and I see no reason to enable them on a desktop. They can be turned off using mitigations=off on your grub command line.
- lima 3y agoA modern desktop has all kinds of sandboxes and other privilege boundaries including the browser, system services restricted using seccomp, various application level sandboxes like Flatpak/Firejail/...
- anotherhue 3y agoThey were shown to be exploitable by JS (though I think V8 had a mitigation, WASM probably not?) Anyway, modern chips have hardware fixes, these microcode updates and kernel retpolines etc. should be less impactful if your CPU was made post-meltdown.
- GartzenDeHaes 3y agoI seen these claims, but I've never seen a publicly available demonstration of these exploits. Converting random bits into meaningful data would seem to be the sticky point.
- fullspectrumdev 3y agoI’ve seen a handful of proof of concept exploits over the years for the speculative execution bugs, none of them really worth caring about. The most impressive was a local exploit for spectre which on certain kernel versions could leak /etc/shadow, and a similar one for windows that sometimes could leak a ntlm hash for local admin user. Both were from a commercial pentesting software company. There’s claims of more impressive ones in academia, but no fucker in academia is sharing their code as usual.
- effie 3y agoCan you share a link to those claims from academia?