Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft disables Spectre mitigations as Intel’s patches cause instability

securityweek.com

Post reply on HN
Print view View original

281–290 of 329 posts

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#281

Post by peterwwillis »

StudentStuff wrote: post #276
peterwwillis wrote: post #175

Earlier quoted context omitted.

Ubuntu user here. Ubuntu is less stable than my second girlfriend, and she tried to stab me once. Lately, every time my co-worker has updated Ubuntu, it has broken his system. He's like my canary in the coalmine. I wait for his system to not fall over before I will update mine.

Maybe its time to consider an OS with better maintainers, like Debian. I've had less issues on unstable/sid over the past few years than I had on the last Ubuntu LTS release (which was what spurred me to Debian). On my other machine, Debian Stretch (and Jessie prior to upgrading) have treated me well, there just isn't breakage when upgrading to the latest stable release or when applying security patches.

I chose Ubuntu because it was more widely supported by 3rd party software vendors and support companies than Debian. But this doesn't matter, because I still ran into hardware and software compatibility issues, and Ubuntu is more up to date than Debian, meaning Debian would have been even more broken by default.

I don't know of a single Linux distro that works out of the box with my laptops. Maybe if I bought a $2,000 laptop that shipped with Linux it would work. It would still be a pain in the ass to update, though.

I kind of hate Linux as a desktop now. I've been using it as such for 14 years, and it's only gotten worse.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#282

Post by paulie_a »

peterwwillis wrote: post #175
rlpb wrote: post #109

Earlier quoted context omitted.

> ...but it happens more often than I would like that I update Linux (Ubuntu) and, lo and behold, I can't really use any programs until I reboot... Ubuntu developer here. This doesn't happen to me in practice. Most updates don't cause system instability. I rarely reboot. Firefox is the most noticeable thing. After updating Firefox (usually it's a security update), Firefox often starts misbehaving until restarted. But…

Ubuntu user here. Ubuntu is less stable than my second girlfriend, and she tried to stab me once. Lately, every time my co-worker has updated Ubuntu, it has broken his system. He's like my canary in the coalmine. I wait for his system to not fall over before I will update mine.

I hope you misspelled exgirlfriend

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#283

Post by dang »

paulie_a wrote: post #282
peterwwillis wrote: post #175

Earlier quoted context omitted.

Ubuntu user here. Ubuntu is less stable than my second girlfriend, and she tried to stab me once. Lately, every time my co-worker has updated Ubuntu, it has broken his system. He's like my canary in the coalmine. I wait for his system to not fall over before I will update mine.

I hope you misspelled exgirlfriend

Please don't post unsubstantive comments here.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#284

Post by CHY872 »

code_duck wrote: post #205
mehrdadn wrote: post #82

Earlier quoted context omitted.

Aaaaaand here comes the Linux defending! OK... > But keep in mind that if your system can't cope with this what you've done there is engineer in unreliability It's weird that you're blaming my operating system's problems on me . "My system" is something a ton of other people wrote, and this is the case for pretty much every user of every OS. I'm not engineering anything into (or out of) my system so I don't get the "…

Why would Linux need ‘defending’ for superior flexibility? The fact that files work like this is an advantage, not a disadvantage. I have never seen the flaw you’ve pointed out actually occurring in practice.

I have! We had a log shipping daemon that wasn't always releasing its file handles properly and kept taking out applications due to out of spacing the box. That said, I drastically prefer the Unix behaviour.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#285

Post by yuhong »

beagle3 wrote: post #32
thanksgiving wrote: post #29

Earlier quoted context omitted.

Speaking of which, why do so many things require reboot to update on Windows?

There is a very fundamental difference between how Unix and Windows view open files: On Windows, once the file is open, it is that filename that is open; You can't rename or delete it; Therefore, if you want to replace a DLL (or any other file) that is in use, you have to kill any program that uses it before you can do that; And if it's a fundamental library everything uses (USER32.DLL COMCTL.DLL etc), the only effec…

What is really irritating is when for example an update that only changes mshtml.dll requires a reboot because a program unnecessarily depends on it. These are not as common as it used to be though.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#286

Post by Mister_Snuggles »

jerf wrote: post #252
Mister_Snuggles wrote: post #248

Earlier quoted context omitted.

I read somewhere that people have developed POCs of these using JavaScript. At minimum, you'll want to keep your browser up to date as there are mitigations happening there too. Who knew that exposing high precision timers to untrusted JavaScript would be a bad idea? Apart from browsers, it's fortunately pretty easy to avoid running code you don't trust on your devices.

What I've seen that the POCs can actually do is not worth running around with your hair on fire, from what I've seen. Note I did not say there is no reason to be concerned about Meltdown and Spectre... just that for most users, uses, and systems, it's not that important. In the next three-to-six months, if you care about security at all, unless you are already running a tip-top tight operation, your money and effort…

I agree with your points. In fact, I made the same argument about removing a Heartbleed/Spectre-related patch that caused issues for one of our applications - "the machine doesn't execute any untrusted code, so this patch isn't strictly necessary."

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#287

Post by mjevans »

jononor wrote: post #106
icebraining wrote: post #42

Earlier quoted context omitted.

Yes, but as far as I know Linus has made no comment on the microcode patches, so mm-vorticesoft is probably referring to the Spectre patches in general.

The microcode patches are binary blobs against a proprietary and secret ISA, how can anyone comment on their quality?

When I read it I believed that Linus was implying that the suggested mitigation was so insane that it seemed like Intel MIGHT be hiding how broken they believed their hardware was with such over-the-top reactions. As well as indirectly asking if they believed the currently accepted mitigation method (retpoline) was considered ineffective.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#288

Post by anonymfus »

Slansitartop wrote: post #269
testplzignore wrote: post #59

Earlier quoted context omitted.

Sounds like Microsoft can't tell the difference between "has AV installed that will break" and "has no AV installed", which makes sense. It's probably infeasible to reliably fingerprint all existing AV software.

> Sounds like Microsoft can't tell the difference between "has AV installed that will break" and "has no AV installed", which makes sense. It's probably infeasible to reliably fingerprint all existing AV software. For something like this, I think best-effort bad-AV detection would have been best. Seems pretty insane to disable security patching because they can't be 100% certain that you have a compatibly AV.

Incompatibility here means unbootable state.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#289

Post by ksk »

code_duck wrote: post #262
ksk wrote: post #239

Earlier quoted context omitted.

I was responding to your own comment >In a case where one could get some sort of inconsistency because of different library versions, you restart the applications. I am envisioning the same scenario you replied to!

Yes, but for some reason you want a GUI alert to tell you important things, which is a foreign concept to me. What I envision is knowing what is running on your server and updating programs purposefully, with knowledge of how they interact and what problems version inconsistency could cause.

You're the one proposing the enumeration of affected programs and services and restarting them as a solution!! How is using a GUI a foreign concept? Are you debating the merits of a GUI in 2018?

In any case, my assumption here is we're trying to help the user and give them an easy way to know what to do, instead of leaving their software in an undefined state.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#290

Post by jameshart »

thanksgiving wrote: post #29
tjoff wrote: post #18

I lost many hours over this last week. The system was unable to boot and finally a thread on reddit came to the rescue ( https://www.reddit.com/r/techsupport/comments/7sbihd/howto_f... ). This actually made the system boot but there are some leftovers being installed on first boot that I've been unable to disable that also causes the system to be unable to boot. So now, the machine is running but as soon as it is res…

Speaking of which, why do so many things require reboot to update on Windows?

So that's a fine question to ask, and you've received many fascinating answers, but can I just suggest that this case - that is, applying patches that relate to the security of your processor cache - is a very fine reason for requiring a reboot, since it will ensure that your processor cache starts out fresh and all behaviors that cause data to be placed there are correctly following the patched behavior.
Post reply on HN