Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spectre mitigations murder userspace performance

robert.ocallahan.org

Post reply on HN
Print view View original

51–60 of 294 posts

Re: Spectre mitigations murder userspace performance

#51

Post by bostonsre »

dustingetz wrote: post #29
dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

your desktop is already rooted by Zoom

Seriously. I hate zoom, there are so many features that smell like malware (how when a call starts sometimes my system level volume no longer is controllable and I have to go to zoom settings to control it. I have windows+wsl, but it's happened on macs in my company as well). Google gets a lot of hate, but I like their meeting tool because they keep it simple and it works.

Re: Spectre mitigations murder userspace performance

#52

Post by edflsafoiewq »

IshKebab wrote: post #23
dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

Kind of feels like apps should opt in to (or out of) mitigations individually. Obviously a web browser needs it, but does Clang? VSCode? Zoom? Probably not.

Didn't browsers implement their own mitigations? Or were those only for some vulns?

Re: Spectre mitigations murder userspace performance

#53

Post by eloff »

treis wrote: post #48
thanksforfish wrote: post #9

Earlier quoted context omitted.

Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.

I thought the browsers had put in their own mitigations that stop spectre/meltdown attacks.

They tried. The V8 team eventually gave up and said it was unwinnable.

What they did do is move tabs to their own process so they can take average of the operating systems protections. Yes you can read the memory of the process hosting the JavaScript, but now there isn't anything interesting in it. Google's security team released a proof of concept attack that can read the memory in the renderer in many systems.

Re: Spectre mitigations murder userspace performance

#54

Post by kzrdude »

IshKebab wrote: post #23
dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

Kind of feels like apps should opt in to (or out of) mitigations individually. Obviously a web browser needs it, but does Clang? VSCode? Zoom? Probably not.

Vscode is a browser

Re: Spectre mitigations murder userspace performance

#55

Post by matsemann »

bostonsre wrote: post #51
dustingetz wrote: post #29

Earlier quoted context omitted.

your desktop is already rooted by Zoom

Seriously. I hate zoom, there are so many features that smell like malware (how when a call starts sometimes my system level volume no longer is controllable and I have to go to zoom settings to control it. I have windows+wsl, but it's happened on macs in my company as well). Google gets a lot of hate, but I like their meeting tool because they keep it simple and it works.

I just changed company. Wish I could go back to Zoom. Google Meet is horrible. I have to open Chrome for all meetings, as it (probably intentionally) runs worse in other browsers. But even in Chrome there are issues. Some workloads (like running tests) can take 5x as long on my system if I'm sharing my screen on Meet. Making working with others more hassle than it should be.

Re: Spectre mitigations murder userspace performance

#56

Post by Verdex »

I have to say that I'm liking the technical discussion here. Although I am surprised that nobody has mentioned the meta topic about the word usage of the title. Like did I miss something and is "murder" actually legit jargon? Or is the author just being dramatic? (Article looked like "kills" would have been perfectly adequate and appropriate.)

Re: Spectre mitigations murder userspace performance

#57

Post by titzer »

FunnyLookinHat wrote: post #4

Should we have a debate as to whether or not Spectre mitigations matter for some (or all) desktop computers? I know that, theoretically, I could install a piece of software on my Linux box that is malware and could try to read my memory via those methods, but let's be honest - we're all mostly concerned with servers that run code for dozens or hundreds of different clients. I'm a foil hat as much as the next - securi…

Mitigations for inter-process side channels address the issue of local applications attacking each other. That includes your web browser, the JS in it, or any other ad-laden crapware attack your local applications, e.g. to steal credit cards, SSH keys, etc.

Side-channels are pernicious. In the limit, they give applications unfettered read access across protection boundaries. If we don't shut them down, we might as well throw out the whole UNIX process boundary security model.

Ask yourself, would it be fine if every process had a 4KB/s (basically dialup speed) connection to read any desired byte of another process's address space?

Of course not. Thus, we need mitigations to shut these channels down.

Re: Spectre mitigations murder userspace performance

#58

Post by jacquesm »

dustingetz wrote: post #29
dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

your desktop is already rooted by Zoom

And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation.

Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Microsoft learned next to nothing from the browser wars lawsuit. They're simply asking to have this done to them again, they now actively discourage Firefox to be installed by claiming it can 'damage your computer' and is insecure. Incredible this stuff.

Oh, and Google will return a link for Chrome as the first item when you search for Adblock for Firefox. You can't make this stuff up.

Has there ever been a large company in IT that didn't turn absolutely evil as soon as the opportunity presented itself?

Re: Spectre mitigations murder userspace performance

#59

Post by c7DJTLrn »

Verdex wrote: post #56

I have to say that I'm liking the technical discussion here. Although I am surprised that nobody has mentioned the meta topic about the word usage of the title. Like did I miss something and is "murder" actually legit jargon? Or is the author just being dramatic? (Article looked like "kills" would have been perfectly adequate and appropriate.)

https://en.wiktionary.org/wiki/superlative

Re: Spectre mitigations murder userspace performance

#60

Post by titzer »

christophilus wrote: post #25
thanksforfish wrote: post #9

Earlier quoted context omitted.

Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.

Yes, but your fans would start spinning like mad. I kill any browser that does that. You’d have to execute a successful attack within a few seconds to pull it off. I think that’s a risk I’ll take.

If this is your security mechanism (chuckle), then attackers will just slow themselves down by duty cycling. Say, only attacking for 100ms at a time, then sleeping a second. You'd never know.
Post reply on HN