141–150 of 294 posts
Earlier quoted context omitted.
> I love that this is a toggle like this, having control of my system is why I love Linux. You can disable mitigations on Windows too.
Yeah but the next update will probably turn it back on silently...
Earlier quoted context omitted.
How long would you have to run JavaScript on your desktop to leak sensitive information and has there been any known exploits in the wild ?
https://leaky.page/ I don't know about the wild, but if this were tuned (i.e. this requires a lot of work for the first byte, the rest are easy) for a HVT you wouldn't know.
This is on Chromium 91.0.4472.106 and kernel 5.12.11-arch1-1. lscpu shows vulnerabilities:
Itlb multihit: KVM: Mitigation: VMX disabled
L1tf: Not affected
Mds: Not affected
Meltdown: Not affected
Spec store bypass: Vulnerable
Spectre v1: Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers
Spectre v2: Vulnerable, IBPB: disabled, STIBP: disabled
Srbds: Mitigation; TSX disabled
Tsx async abort: Not affectedEarlier quoted context omitted.
I suspect our heavy reliance on speculative execution is just a local optimum, and we can grow out of it by providing the processor more information about the data flow, making memory access more explicitly asynchronous, and simplifying the hot paths. I like the way the mill approaches these architectural problems.
I'm very unconvinced by these arguments. Providing enough information to the processor to claw back all the performance that predictors give you, that requires some way of knowing all those things in advance. Statically. And so you fall into the pit of tar and despair that is relying on Sufficiently Smart Compilers. Same one that couldn't save Intel's shiny new IA-64 architecture (the "Itanic"). Static analysis is ju…
How will we ever know that a Sufficiently Smart Compiler is impossible, if we never have processors where compiler intelligence is useful?
Earlier quoted context omitted.
And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation. Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Micro…
I just setup 2 laptops this week on Win10 Pro, inatlled Firefox and Chrome, and nowhere did it mention anything about Firefox being bad? Maybe a Win10 Home, or some other version? Or was that in a search result (or ad) not actually Windows?
Edit: On re-reading, I believe OP was specifically referring to false positives with SmartScreen that crop up regularly, like at https://www.reddit.com/r/firefox/comments/n7gige/ms_edge_blo...
Earlier quoted context omitted.
> I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Turning off speculative execution reduces performance enormously . Yes, code is often less efficient than it could be but "surprise, you need 5x as large of a datacenter because your hardware isn't doing fancy stuff" is not going to…
I suspect our heavy reliance on speculative execution is just a local optimum, and we can grow out of it by providing the processor more information about the data flow, making memory access more explicitly asynchronous, and simplifying the hot paths. I like the way the mill approaches these architectural problems.
IMO we need to bring back segmentation hardware. Not the x86 version of segmentation (there's not a feature that x86 wasn't able to make twice as complicated as it needed to be while only giving you half the use cases), but the cleaner object capability on top of paging hardware versions of segmentation. That solves the really rough Spectre cases like even NetSpectre where you can slurp out kernel state remotely from untrusted network packets. Just stick them in a "this memory is untrusted" segment. From there the CPU's dynamic dataflow optimizations can include speculation where memory is marked as trusted.
Earlier quoted context omitted.
Yeah but the next update will probably turn it back on silently...
Unlikely; Windows updates (mostly) only turn things you disabled back on if they're harmful to you.
Earlier quoted context omitted.
/second NoScript. Instead of whitelisting whole sites, you can whitelist links to JavaScript imports across all sites, temporarily or permanently. So for example, you can whitelist urls to all the major JavaScript frontend frameworks’ CDNs, like bootstrap, etc. while leaving known trackers and spyware blacklisted by default. Anecdotally it seems most websites still work with their trackers disabled, as long as they h…
I disagree. There are way too many sites that require javascript that you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.
Earlier quoted context omitted.
I'm continually shocked that people are so ok with automatically executing any code random sites they connect to shove at them.
Code is data. Data is code.
If you want to be overly reductionist then you can argue nothing matters because your just staring at a box with lights in it.