Is it advisable to put off any device purchases until this issue is fixed in a new generation of CPUs? So in 1-2 years?
Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
1–10 of 61 posts
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#2I don't see either of the bugs going away for consumer hardware? Both are somewhat fundamental optimizations and does not affect running trusted software.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#3The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software.
The Javascript attack vector for Spectre will be patched by browser vendors.
If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#4At scale or for personal use?
If at scale, you probably don’t have an option because you need it now.
If for personal use, we don’t know what the fix would look like, or whether there would be a perf hit. If you can hold off for a few years sure do it, but it’s not a huge part of the equation now.
How long will this device last you? If less than 2 years buy now.
Honestly very few reasons to wait. Everyone has this problem. The only thing I might wait for is clarification of the attack surface area of spectre since that can’t be patched but it seems like it’s difficult to pull off in most cases.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#5The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.
Isn’t the performance loss due to KPTI still a big factor for consideration? The security risk might not be huge but you’re still losing at least some performance due to added overhead on nearly every OS.
I suppose you could disable it on Linux, but at that point it seems like you’re going against the tide.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#6I still bought. Even if there are changes to the systems in the future to address them at a lower level, it'll be at least one generation away probably two. The timelines on designing new CPUs are multi-year beasts because of the complexity, and with the next generation happening "soon" I doubt a redesign could be feasible for them. So your looking at what I'd guess is a year or so for any movement.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#7Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads.
Fixing these bugs at CPU level will require changes in architectures. Such sweeping changes won't come for years. Intel has not made such a overhaul in years and AMD just made one.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#8I mean if you’re building a pc from scratch you could just factor in some overclocking to make up some of the performance loss I’d imagine. In the future we probably just won’t see the advertised speeds of chips increasing much IF the performance impact is as big as people are saying.
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#9The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.
> The Javascript attack vector for Spectre will be patched by browser vendors
Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/...
Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?
#10Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing th…
Quite. If Intel, AMD, and ARM just slam in fixes now and release as soon as they can, assuming that's even possible, there's a significant chance they'll introduce other security problems. To gain a high degree of confidence that hasn't happened will most likely require extensive design iteration, verification, and testing so, yeah, years unfortunately.