3 ms·

I'm still of the opinion the industry response to spectre was wildly overblown. It's been five years and not one single damn person has been a confirmed victim

• insanitybit 3y ago
  > It's been five years and not one single damn person has been a confirmed victim of it yet Well, everyone patched things pretty aggressively, so exploitation isn't really practical. At minimum, that's why. Also, vuln research can take a long time to turn into exploits - there are so many existing primitives that people are exploring right now (ebpf, io_uring) that have practical exploitation primitives already designed, so there isn't much pressure to go for something that's already patched and that would require a lot of novel research to find reliable primitives for it. As for the mitigations, just disable them? They're on by default because Linux doesn't know what your use case is, but if your use case isn't relevant to the mitigation's threat model please feel free to disable them. It is very simple to do so.
  • causality0 3y ago
    Oh I did. I never installed the patches in the first place and I've been a regular user of InSpectre.
• dzaima 3y ago
  If 99.99% of people have patched their systems against Spectre, there's no reason for anyone to bother exploiting it. But if noone patched their systems, it'd obviously be exploited far and wide because it demonstrably can be.