Spectre mitigations murder userspace performance

Post by jacquesm » Sat, Jun 19, 2021, 2:03 PM UTC

matsemann wrote: post #55

bostonsre wrote: post #51

Earlier quoted context omitted.

Seriously. I hate zoom, there are so many features that smell like malware (how when a call starts sometimes my system level volume no longer is controllable and I have to go to zoom settings to control it. I have windows+wsl, but it's happened on macs in my company as well). Google gets a lot of hate, but I like their meeting tool because they keep it simple and it works.

I just changed company. Wish I could go back to Zoom. Google Meet is horrible. I have to open Chrome for all meetings, as it (probably intentionally) runs worse in other browsers. But even in Chrome there are issues. Some workloads (like running tests) can take 5x as long on my system if I'm sharing my screen on Meet. Making working with others more hassle than it should be.

Post by jacquesm » Sat, Jun 19, 2021, 2:04 PM UTC

eloff wrote: post #53

treis wrote: post #48

Earlier quoted context omitted.

I thought the browsers had put in their own mitigations that stop spectre/meltdown attacks.

They tried. The V8 team eventually gave up and said it was unwinnable. What they did do is move tabs to their own process so they can take average of the operating systems protections. Yes you can read the memory of the process hosting the JavaScript, but now there isn't anything interesting in it. Google's security team released a proof of concept attack that can read the memory in the renderer in many systems.

Post by marcosdumay » Sat, Jun 19, 2021, 2:12 PM UTC

dustingetz wrote: post #29

dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

your desktop is already rooted by Zoom

Post by jwif029jf209jf » Sat, Jun 19, 2021, 2:19 PM UTC

christophilus wrote: post #25

thanksforfish wrote: post #9

Earlier quoted context omitted.

Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.

Yes, but your fans would start spinning like mad. I kill any browser that does that. You’d have to execute a successful attack within a few seconds to pull it off. I think that’s a risk I’ll take.

Post by swiley » Sat, Jun 19, 2021, 2:20 PM UTC

josefx wrote: post #62

dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

> not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.