Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#21

Post by chrisper »

JohnJamesRambo wrote: post #19
chrisper wrote: post #14

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or lo…

But why did you get a new CPU if you don't need horsepower? Not saying this is you, but I don't understand people that have to have the fastest processor but then rationalize away these losses in power with "I don't use my CPU much anyway."

That is not what I meant. My new CPU is much faster than the old one. I was hitting the limits at certain times. And now that I finally can afford upgrading, I did. But this was all before we knew about Meltdown / Spectre...

Of course I am annoyed by the fact that I will lose some power. But I do not have much of a choice now, do I?

Either way, I am not utilizing my CPU the way servers with many users do. These servers will feel this impact the most.

I personally don't care if I lose 2 fps or if my compilation will take 20 seconds longer after all these fixes. But if you budget let's say 5000 USD per month for servers and everything was running fine and now it turns out you need to add an additional 3000 USD a month, then that's where the impact is felt the most and not with normal users like us where the compilation time might take a bit longer.

Also, for some people it is just a hobby to always have the latest and best :)

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#22

Post by ZenoArrow »

barrkel wrote: post #20
ZenoArrow wrote: post #15

Earlier quoted context omitted.

Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.

There are two components: the branch prediction needs to be trained (to get it to speculatively execute the right instructions on context switch to the victim process) and precise timing needs to be available (to exfiltrate data using differences in what got cached). Without executing code, it's difficult to see how the two components could be triggered. Loading complex file formats is structurally similar to interpr…

Sure, JS was the most obvious attack vector, but my point was that it's not limited to JS. Any code that runs natively on an affected computer can exploit it. The only advantage JS has is that it's easier to get targets to run malicious code through a web browser. You seem to be in agreement with me on this.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#23

Post by chrisper »

microtonal wrote: post #17
chrisper wrote: post #14

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or lo…

The cynic in me is amazed how people complain about a loss of 0-30% in performance on the desktop (depending on the workload), but are completely happy to replace native applications by Electron applications and/or web applications. Of course, these may be disjoint sets of people. I think when it comes to most desktop workloads, the security issues are far more interesting and serious. And while Meltdown only affects…

The problem, I think, is a psychological one.

No one likes to get stuff taken away. People were also annoyed how "bad" their VW drives after the diesel fixes. Even if you probably never hit the limits to feel the difference, just the thought that from now on your CPU could be slower than it was yesterday is annoying enough.

But I agree with you. It is the wrong crowd that complains the loudest!

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#25

Post by kazinator »

microtonal wrote: post #17
chrisper wrote: post #14

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or lo…

The cynic in me is amazed how people complain about a loss of 0-30% in performance on the desktop (depending on the workload), but are completely happy to replace native applications by Electron applications and/or web applications. Of course, these may be disjoint sets of people. I think when it comes to most desktop workloads, the security issues are far more interesting and serious. And while Meltdown only affects…

If your CPU takes a performance hit, it will affect everything, including the non-native applications.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#26

Post by javitury »

quantummkv wrote: post #7

Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing th…

> Unless you are building a server, it does not matter

The average HN user is not the typical desktop/laptop user. I bet we use virtual machines, compilers, technologies like nvme, databases (postgres/mysql)... more often than the typical desktop/laptop user.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#27

Post by et-al »

Pilfer wrote: post #12
mkagenius wrote: post #9

Earlier quoted context omitted.

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/...

iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.

Ugh.. when Apple introduced apps and stickers into iMessage, I knew it could be a vector for attacks.

Too bad Apple doesn't give users the option to have only "text-only" messages.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#28

Post by TeMPOraL »

quantummkv wrote: post #7

Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing th…

> Your GPU handles a lot of desktop heavy workloads such as gaming.

Depends on a game, though. While true in most cases, one of my favourites - Kerbal Space Program - is heavily CPU-bound due to being mostly a real-time physics simulation.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#29

Post by Yetanfou »

mrunseen wrote: post #11
mkagenius wrote: post #9

Earlier quoted context omitted.

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/...

Maybe OS-wide blocker for malicious JS?

No thanks, just thinking about running 'Norton Anti-JS' (et al) on a server is enough to induce nausea.

In other words, blocking 'malicious' code is reactive, not pro-active. Reactive solutions by definition end up solving yesterday's problems while being oblivious to today's - viz. liquids restriction in hand luggage.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#30

Post by quantummkv »

javitury wrote: post #26
quantummkv wrote: post #7

Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing th…

> Unless you are building a server, it does not matter The average HN user is not the typical desktop/laptop user. I bet we use virtual machines, compilers, technologies like nvme, databases (postgres/mysql)... more often than the typical desktop/laptop user.

Yes, we do. But I doubt anyone is using them for production workloads. Development workloads don't continuously push cpu to 100% or even 70% for large periods of time. Development workloads don't make 1000 req/sec on postgres. No one has 10 vm's running at a time on a desktop.

These perf issues will only affect the server and cloud providers or some edge cases on the desktop. Everyone else can just apply the patches and go to work.

Post reply on HN