Hacker News Reader

Comment by rayiner | Hacker News Reader

I don't like how these Scepter mitigations are being rolled out with no cost/benefit analysis. On a client machine, I'd rather just disable Javascript than pay a 30-50% performance penalty for mitigating these vulnerabilities.

View on HN

A system running a browser probably has other problems, but just take every supercomputer ever or the vast majority of embedded systems.

Running other peoples code (on other peoples machines) is a cloud thing, but they have an iron grip on the kernel and other software.

I would rather wait for reports of dangerous JavaScript exploits in the wild, myself. Considering that no real-world exploits of Spectre and related attacks have actually been reported, the odds that I'll fall victim to such an exploit without hearing about it in plenty of time to mitigate it are in the millions to one.

Instead, everyone has to pay the performance tax proactively, regardless of their individual threat model. That is not how this sort of thing should be handled.

Would you like a nuclear powerplant to be ran with this kind of approach to safety? Given the amount of possible targets and how unreliable people can be at assessing what risk they're exposed to, having mitigation active by default is obviously the only sane answer.

Somehow I doubt nuclear power plants run (unmodified) Linux kernels released in the last 5 years

Exactly... they're running on XP so it's all good

When I went to Sellafield they had Win3.1 on the fuel rod chopping machine in the reprocessing plant (admittedly in '97!)

Psst, every machine on the Internet must now be hardened to conform to nuclear and aerospace industry standards. So sayeth the Priesthood of Infosec. Haven't you heard?

That's probably not enough.

Sorry, but that's my call, not yours. My computer is not a nuclear power plant.

Are there any of those changes you can't disable for your computer? I thought all(?) of them were behind flags, since different hardware needs different sets.

The Linux team also needs to make a call on the kernel they maintain. You can always choose to stick with an older kernel or even patch out the fixes if you like.

Yeah, that scales really well. The answer to every overreaction and questionable policy is always, "Just rebuild your kernel."

I have been meaning to ask about this. How vulnerable are desktops to these exploits?

As has already been said JavaScript, Flash and such are the biggest risk. Browser vendors have tried to mitigate the attacks, but last I heard, only Mozilla's mitigation was actually effective at preventing attacks.

I'd also personally not feel comfortable using a Windows PC, given that running unchecked 3rd-party code is sort of required to do anything with it.

There are exploits written in Javascript that run on a browser.

Is there any way these could be mitigated at the browser level in this case?

Do you expect Grandpa to do that analysis? The mitigations are probably behind KCONFIG flags anyway.

No need to modify build config, this and other spectre mitigations can be disabled in cmdline (spectre_v2=off)

Reply on news.ycombinator.com