Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#11

Post by mrunseen »

mkagenius wrote: post #9
Pilfer wrote: post #3

The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/...

Maybe OS-wide blocker for malicious JS?

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#12

Post by Pilfer »

mkagenius wrote: post #9
Pilfer wrote: post #3

The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/...

iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#13

Post by sytelus »

quantummkv wrote: post #7

Unless you are building a server, it does not matter. Your GPU handles a lot of desktop heavy workloads such as gaming. If you are building servers or a machine for CPU intensive tasks such as compiling chromium every hour, then you might want to look at AMD. The major performance hits are caused by meltdown patches that do not affect AMD. And the amount of cores they give certainly help in these workloads. Fixing th…

Looks like Intel is already out with a patch for Meltdown: https://www.theverge.com/2018/1/4/16850776/intel-meltdown-sp...

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#14

Post by chrisper »

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times.

The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies).

I'd say if you are talking about a large quantity purchase, you should maybe wait or look for alternatives. Other than that it should not make much difference for us "normal folks."

Another truth is that there is / was so much misinformation out there.

Finally, I wonder if there are going to be any optimizations to these fixes in the future?

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#15

Post by ZenoArrow »

Pilfer wrote: post #12
mkagenius wrote: post #9

Earlier quoted context omitted.

> The Javascript attack vector for Spectre will be patched by browser vendors Not just limited to browsers though. Content may be injected via other sources. Its difficult to get an exhaustive list of such application. But here is an example of iMessage : https://threatpost.com/inside-the-latest-apple-imessage-bug/...

iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.

Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#16

Post by chrisper »

Pilfer wrote: post #3

The Meltdown and Spectre attacks require code execution on your local machine. You can avoid both the Meltdown and Spectre attacks by not downloading and running untrusted software. The Javascript attack vector for Spectre will be patched by browser vendors. If you operate safe computing practices it is unlikely you will be hit by either the Meltdown or Spectre attacks.

Yep, until your "trusted code" (e.g. Apache, PHP,...) has a remote code execution vulnerability.

This is such a dangerous advice... you should really only disable these things if:

a) your computer is not connected to the internet in any way

b) it is in a trusted environment

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#17

Post by microtonal »

chrisper wrote: post #14

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or lo…

The cynic in me is amazed how people complain about a loss of 0-30% in performance on the desktop (depending on the workload), but are completely happy to replace native applications by Electron applications and/or web applications. Of course, these may be disjoint sets of people.

I think when it comes to most desktop workloads, the security issues are far more interesting and serious. And while Meltdown only affects Intel CPUs, Spectre affects all (?) out-of-order CPUs and there may be more/more effictive attacks in the future. So every fast, modern CPU is pretty much in the same boat and it will take some time for the dust to settle.

So, I would just stick with the Intel CPU. You can vote with your wallet once one vendor decides to axe ME/PSP and/or properly mitigates Spectre-type attacks ;).

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#18

Post by vbezhenar »

If you want Intel and can wait, I would wait. They should fix Meltdown bug and it'll increate performance significantly in some edge cases. I think they'll release such processor in 2018. Spectre won't be fixed for a long time, so it should not affect purchase decisions.

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#19

Post by JohnJamesRambo »

chrisper wrote: post #14

I just got an 8700k last week. I was thinking about returning it and go with Amd instead. The truth is, I do not do many tasks on my home computer where the CPU is going to be at >50% at all times. The other truth is, that Intel CPUs are just faster than Amd Cpus (now with a few exceptions, but for general use that still applies). I'd say if you are talking about a large quantity purchase, you should maybe wait or lo…

But why did you get a new CPU if you don't need horsepower? Not saying this is you, but I don't understand people that have to have the fastest processor but then rationalize away these losses in power with "I don't use my CPU much anyway."

Re: Ask HN: Delay buying new devices due to Meltdown/Spectre CPU bug?

#20

Post by barrkel »

ZenoArrow wrote: post #15
Pilfer wrote: post #12

Earlier quoted context omitted.

iMessage uses the WebKit rendering engine to run Javascript. The WebKit engine will be patched by its vendor Apple.

Unless I'm missing something, Spectre isn't really a JS-based vulnerability. As far as I know, any code that runs directly on a computer with one of the affected CPUs could be used to perform the Spectre attack. Feel free to correct me if I'm wrong.

There are two components: the branch prediction needs to be trained (to get it to speculatively execute the right instructions on context switch to the victim process) and precise timing needs to be available (to exfiltrate data using differences in what got cached). Without executing code, it's difficult to see how the two components could be triggered.

Loading complex file formats is structurally similar to interpreting code; the output of the interpretation is some data structure, rather than some side effect, but otherwise it's very similar. There may be some loaders that are controllable and configurable enough to be programmed by data - perhaps something in the video decoding space that isn't offloaded to dedicated hardware or GPU - but I think it would be tough to find. JS or a downloadable game (which already lets people in the front door) of some kind are the best vectors.

Post reply on HN