Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spectre mitigations murder userspace performance

robert.ocallahan.org

Post reply on HN
Print view View original

71–80 of 294 posts

Re: Spectre mitigations murder userspace performance

#71

Post by dijit »

josefx wrote: post #62
dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

> not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.

I don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy.

I tend to agree with what you're saying but the ship has sailed very much and running without javascript is a losing proposition these days.

(my web browser starts up with javascript disabled except for some whitelisted sites and it usually only takes 15 minutes for me to find something completely broken on the internet and re-enable javascript entirely).

Re: Spectre mitigations murder userspace performance

#72

Post by sneak »

dijit wrote: post #71
josefx wrote: post #62

Earlier quoted context omitted.

> not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.

I don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy. I tend to agree with what you're saying but the ship has sailed very muc…

Nah. I browse the web with NoScript. Snowden himself says to disable scripting in browsers.

Re: Spectre mitigations murder userspace performance

#73

Post by Santosh83 »

jacquesm wrote: post #58
dustingetz wrote: post #29

Earlier quoted context omitted.

your desktop is already rooted by Zoom

And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation. Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Micro…

I run Windows 10 (Home) since years and the OS has so far, never tried to warn me about Firefox. It does however reset default browser back to Edge after biannual major OS upgrades. Also searching 'adblock for Firefox' on Google returns several results from Mozilla addons for me. Chrome is not linked anywhere on the first page of results.

What is personally more annoying is Edge keeps randomly popping up a banner asking if I'm sure it shouldn't be the default browser. When a user declines once, the OS shouldn't nag repeatedly.

Re: Spectre mitigations murder userspace performance

#74

Post by voakbasda »

dijit wrote: post #71
josefx wrote: post #62

Earlier quoted context omitted.

> not just in the form of Javascript but that's the largest example I can think of. As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.

I don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy. I tend to agree with what you're saying but the ship has sailed very muc…

Entirely? Use NoScript to temporarily enable only those portions of the single site that you need. No affiliation, just a happy user.

Re: Spectre mitigations murder userspace performance

#75

Post by akersten »

Verdex wrote: post #56

I have to say that I'm liking the technical discussion here. Although I am surprised that nobody has mentioned the meta topic about the word usage of the title. Like did I miss something and is "murder" actually legit jargon? Or is the author just being dramatic? (Article looked like "kills" would have been perfectly adequate and appropriate.)

Well, the marketing of these vulnerabilities was also bombastic and hyperbolic, so it follows that the retorts should employ similar language so they are taken just as seriously.

Re: Spectre mitigations murder userspace performance

#76

Post by nerdponx »

jacquesm wrote: post #58
dustingetz wrote: post #29

Earlier quoted context omitted.

your desktop is already rooted by Zoom

And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation. Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Micro…

> Has there ever been a large company that didn't turn absolutely evil as soon as the opportunity presented itself?

No?

Re: Spectre mitigations murder userspace performance

#77

Post by temac »

dijit wrote: post #14
neilsimp1 wrote: post #2

`mitigations=off` in your GRUB_CMDLINE_LINUX_DEFAULT to disable Spectre/Meltdown mitigations, in case anyone is wondering. This page has a pretty decent write-up on it: https://leochavez.org/index.php/2020/11/16/disabling-intel-a... .

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

> I love that this is a toggle like this, having control of my system is why I love Linux.

You can disable mitigations on Windows too.

Re: Spectre mitigations murder userspace performance

#78

Post by ghoward »

I would love to see new chips that take all of the transistors used for speculation and use them for more cores. I asked electrical engineers once how many of the transistors on a chip serve speculation, and they said, "To a first approximation, 100%."

That means we could add a lot more cores. Add enough, and the OS could easily pin basically all processes/threads to their own cores.

And that, I believe, might win some performance back.

I have more ideas at [1].

[1]: https://gavinhoward.com/2020/02/computing-is-broken-and-how-...

Re: Spectre mitigations murder userspace performance

#79

Post by temac »

hjek wrote: post #44
thanksforfish wrote: post #9

Earlier quoted context omitted.

Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. So the risk may be closer to "clicking a link". https://www.zdnet.com/article/google-this-spectre-proof-of-c... Additionally, the passwords and keys on your local dev box are very valuable for further attacks, like supply chain attacks.

> Unfortunately "install a piece of software" also includes allowing javascript to run in your browser. Per-process Spectre mitigations could be helpful there, but I don't understand the technical details to know whether that would be possible to implement. It would be nice to disable mitigations on a video editor and for gaming.

Opt-in per-process spectre mitigation is already the case for some of them, because the mitigations in question are way too costly.

Now it is not possible for every kind of mitigations, because e.g. patching the kernel between mitigated processes and unmitigated ones would be more costly than just always running the mitigations.

edit: thinking more about it: you could have crazy ideas like two versions of the whole kernel space always loaded :D not sure about the cache impact in this case though.

Re: Spectre mitigations murder userspace performance

#80

Post by amelius »

neilsimp1 wrote: post #2

`mitigations=off` in your GRUB_CMDLINE_LINUX_DEFAULT to disable Spectre/Meltdown mitigations, in case anyone is wondering. This page has a pretty decent write-up on it: https://leochavez.org/index.php/2020/11/16/disabling-intel-a... .

What if your system is virtualized?
Post reply on HN