Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spectre mitigations murder userspace performance

robert.ocallahan.org

Post reply on HN
Print view View original

151–160 of 294 posts

Re: Spectre mitigations murder userspace performance

#151

Post by saagarjha »

foobiekr wrote: post #138
lumost wrote: post #89

Earlier quoted context omitted.

has there been any research on what hardware changes would be necessary to reclaim performance? I've noticed extreme stutter events on desktop OSX for the last 2 years. Would be curious if its related.

You can turn macOS into Windows 3.1 reading a floppy by mounting an SMB share with a ton of small files and running an rclone sync between it and an external drive that has previously completed a sync. The stat() operations make the kernel go crazy. It’s the most appalling thing I’ve seen and has been broken like this since Catalina where it arrived as a massive performance regression.

You don’t even need networked storage for that, just attach a slow spiny disk and it’ll grind every app accessing the filesystem (even if those files are on a super fast internal SSD!) to a halt at random points.

Re: Spectre mitigations murder userspace performance

#152

Post by toomanyducks »

a1369209993 wrote: post #141
SteveNuts wrote: post #108

Earlier quoted context omitted.

Yeah but the next update will probably turn it back on silently...

Unlikely; Windows updates (mostly) only turn things you disabled back on if they're harmful to you.

idk about this, my anecdotal experience suggests otherwise - irrelevant things (i.e., monitor resolutions, mouse acceleration curves, and I think DNS settings at one point) can be thrown around by updates a bit too frequently in my experience.

Re: Spectre mitigations murder userspace performance

#153

Post by saagarjha »

fiddlerwoaroof wrote: post #128
FunnyLookinHat wrote: post #90

Earlier quoted context omitted.

Yeah no disagreement there. I had totally forgotten about the JS POC - ugh! The JavaScript argument is interesting to me in that it's already flawed. I suppose I'd rather focus on the security issues with browsers running code on my computer more than anything else since it's effectively the "but what about ___" answer to so many threads like this one. I've seen a few other comments suggesting per-process rules to en…

With Arm big.little architectures, it could start making sense to have dedicated in-order cores for running JavaScript and other “untrusted” code. Also, I wonder if disabling mitigations on the desktop and running the browser in a VM with mitigations enabled would be effective.

People want their websites to load fast, though.

Re: Spectre mitigations murder userspace performance

#154

Post by saagarjha »

wizzwizz4 wrote: post #143
tux3 wrote: post #26

Earlier quoted context omitted.

I'm very unconvinced by these arguments. Providing enough information to the processor to claw back all the performance that predictors give you, that requires some way of knowing all those things in advance. Statically. And so you fall into the pit of tar and despair that is relying on Sufficiently Smart Compilers. Same one that couldn't save Intel's shiny new IA-64 architecture (the "Itanic"). Static analysis is ju…

> And so you fall into the pit of tar and despair that is relying on Sufficiently Smart Compilers. How will we ever know that a Sufficiently Smart Compiler is impossible, if we never have processors where compiler intelligence is useful?

> And so you fall into the pit of tar and despair that is relying on Sufficiently Smart Compilers. Same one that couldn't save Intel's shiny new IA-64 architecture (the "Itanic").

Re: Spectre mitigations murder userspace performance

#155

Post by SkyMarshal »

gruez wrote: post #98
SkyMarshal wrote: post #87

Earlier quoted context omitted.

/second NoScript. Instead of whitelisting whole sites, you can whitelist links to JavaScript imports across all sites, temporarily or permanently. So for example, you can whitelist urls to all the major JavaScript frontend frameworks’ CDNs, like bootstrap, etc. while leaving known trackers and spyware blacklisted by default. Anecdotally it seems most websites still work with their trackers disabled, as long as they h…

I disagree. There are way too many sites that require javascript that you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.

I disagree. I'm not just pulling this out of my ass, I've been doing exactly this for years, I can't remember how long. It works fine.

>you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.

The key here is that when you're deciding whether to whitelist a JS import, and you don't know what it is and don't want to take the time to look it up, then whitelist it temporarily not permanently. It will be moved back to the blacklist the next time you restart the browser.

Only permanently whitelist JS that you know for sure isn't a tracker or malware or sketchy.

Re: Spectre mitigations murder userspace performance

#156

Post by saagarjha »

astrange wrote: post #10
nickpeterson wrote: post #3

I’ve made similar comments in the past but I think we’re just trying to predict too much about what programs are trying to do in hardware. I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Most of the real slowdowns anyone has in day to day performance has more to do with inefficient…

> I’d rather have simple hardware that is light on energy requirements and easier to understand. I don’t think software as an industry really has a “this chip isn’t fast enough problem”. Have you seen how happy people are with M1 machines? That's because it's faster. It's definitely not simpler. > Most of the real slowdowns anyone has in day to day performance has more to do with inefficient code than hardware anyway…

Wait until Slack outfits their developers with M1 machines and we’ll quickly be back to being unhappy again.

Re: Spectre mitigations murder userspace performance

#157

Post by _meqs »

hutzlibu wrote: post #131
jacquesm wrote: post #58

Earlier quoted context omitted.

And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation. Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Micro…

" Has there ever been a large company in IT that didn't turn absolutely evil as soon as the opportunity presented itself?" I like nuances, though. "absolute evil" is a bit strong. There were companies who were engaged with enslaving people and working them to death. (some still are) I am no fan of googles development, but absolute evil leaves no room to describe other companies who are actually worse.

> some still are

well that's an understatement[0].

I alos think it's less productive to interpret the phrase absolute evil as a comment on an entity's moral alignments (because it's a corporation, it's not chaotic evil or neutral good, it just is) but as a comment on the foundation and effects of the economic and political systems defining of the corporations (capitalism under neoliberalism). Absolute evil seems like a fairly decent personification of those metrics to me: every extra push to manufacture another product pushes us closer to a climate catastrophe (even 'green' products like Teslas, especially green products like Teslas[1]). Even if you deny climate change, you can't deny that workers are being taken advantage of near habitually. If we're going to personify the destruction of the earth and the worker, absolute evil does not seem too far off.

0: https://en.wikipedia.org/wiki/Foxconn_suicides for one 1: https://www.wired.com/2016/03/teslas-electric-cars-might-not...

Re: Spectre mitigations murder userspace performance

#158

Post by rkagerer »

tyingq wrote: post #20
dijit wrote: post #14

Earlier quoted context omitted.

I love that this is a toggle like this, having control of my system is why I love Linux. But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop. Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the large…

Nice 3rd party toggle for windows: https://www.grc.com/inspectre.htm Or a Powershell script from MS: https://support.microsoft.com/en-us/topic/understanding-get-...

I'd like some more technical details on what exactly InSpectre does (specifically for the Meltdown patch). e.g. Does it just flip a registry key? Rewrite a microcode patch somewhere? Couldn't find an explanation in the software (even under Show Tech Details) or on their site; could you point me to it?

Also, do all the major browsers now have their own mitigations built in?

Re: Spectre mitigations murder userspace performance

#159

Post by kevingadd »

callahad wrote: post #145
bennyp101 wrote: post #123

Earlier quoted context omitted.

I just setup 2 laptops this week on Win10 Pro, inatlled Firefox and Chrome, and nowhere did it mention anything about Firefox being bad? Maybe a Win10 Home, or some other version? Or was that in a search result (or ad) not actually Windows?

Give it time; it's a trickle campaign. Just this morning I updated my Win 10 Pro desktop, and on reboot I got a full screen wizard prompting me to "use recommended browser settings" which is doublespeak for changing my default browser to Edge. Edit: On re-reading, I believe OP was specifically referring to false positives with SmartScreen that crop up regularly, like at https://www.reddit.com/r/firefox/comments/n7gig…

The SmartScreen stuff is a plague that applies to all software developers in varying degrees. Chrome does this with their safe browsing stuff too, I hate it - essentially everyone gets told your exe is "malicious" until enough people have downloaded it without it being flagged as malware.

The idea that it applies to trusted vendors like Mozilla shipping code-signed executables is bonkers to me.

Nice way to promote further centralization into services like app stores that don't suffer from this!

Re: Spectre mitigations murder userspace performance

#160

Post by argomo »

gruez wrote: post #98
SkyMarshal wrote: post #87

Earlier quoted context omitted.

/second NoScript. Instead of whitelisting whole sites, you can whitelist links to JavaScript imports across all sites, temporarily or permanently. So for example, you can whitelist urls to all the major JavaScript frontend frameworks’ CDNs, like bootstrap, etc. while leaving known trackers and spyware blacklisted by default. Anecdotally it seems most websites still work with their trackers disabled, as long as they h…

I disagree. There are way too many sites that require javascript that you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.

I used to do this. It broke too often when doing credit card purchases though... it would take multiple attempts to complete a purchase and figure out which domains needed to be enabled. Sometimes the status would be left ambiguous. Once I double-spent, but fortunately it was a cancellable reservation. I suppose you can do better if you just spend at a few key sites.
Post reply on HN