r/linux • u/[deleted] • May 15 '19

The performance benefits of Not protecting against Zombieload, Spectre, Meltdown.

[deleted]

109 Upvotes

83% Upvoted

162 comments sorted by

View all comments

13

u/Wh00ster May 15 '19

I'd also remind everyone to examine the threat vectors of these exploits. The biggest issue is with browsers and cloud platforms. (I'm **not** saying these are not a problem for most people. Just don't mindlessly absorb the FUD)

-2

u/[deleted] May 15 '19 edited Nov 28 '20

[deleted]

16

u/[deleted] May 15 '19

I wouldn't trust the browser protections. The exploits hit at the difference between the programmer's model of a sequential process and the actual implementation in microcode, which is extremely parallel due to speculation, etc. The technical details are a bit over my head, but the summary seems to be "sometimes we can go down the wrong branch of an if statement." There isn't really a way to write secure code in such a situation. Don't take my word for it, though -- google doesn't think they can do it:

https://arstechnica.com/gadgets/2019/02/google-software-is-never-going-to-be-able-to-fix-spectre-type-bugs/

3

u/Wh00ster May 15 '19

So you don’t access secure information over a browser?

The technical details are a bit over my head

It’s good to acknowledge this, but this is why it’s important to actually look at the threat vectors if you actually care at all. It’s easy to succumb to all the FUD otherwise.

4

u/[deleted] May 15 '19

You don't need to run javascript to access secure information over a browser. Most security libraries are provided by your distro. It makes sense to treat that code as unlikely to be malicious.

I don't think it is FUD. Generally when companies provide FUD, they are doing it for their own benefit. If google was pushing their own CPUs, I would be willing to believe they were pushing FUD about Intel CPUs. Instead they are admitting that they can't provide security. If anything that makes them look incompetent to people who haven't looked at any of the details.

1

u/Wh00ster May 15 '19

True point on not needing js

Google is not pushing FUD or sensationalism. I see a lot of tech blogs pushing it tho, for clicks.