Hacker News Reader

Comment by ksec | Hacker News Reader

I used to be Pro Anandtech and consider them one of the best Sources online for Hardware News. But the fact they have yet write a single post, big or small about Intel's Zombieload and its implication on performance worries me a bit.

Then there is the "Intel" benchmarks as usual [1] on GPU. Trying to suggest the 2 CPU were both running at 25W TDP to give a "fair" comparison, without mentioning the Ice-Lake U CPU were running with 50% more memory bandwidth vs the AMD Ryzen. And we know Graphics Benchmarks do depend a lot on memory bandwidth. The memory used was somehow mentioned in Toms or Other Sites but not Anandtech. ( Although none of them had mentioned the bandwidth difference, it was up to the reader to work them out )

Anyway none of these Consumer CPU upgrade interest me anymore ( Although any improvement to iGPU would be great ) I am eagerly waiting for a 2S - 128 Core EPYC 2 on a Server or AWS to play around with it.

[1] https://www.anandtech.com/show/14405/intel-teases-ice-lake-i...

Edit: And the lesson here, never trust a single news source. Always have a few option opened and fact check yourself. ( If you have the time )

View on HN

It's not just Anandtech.

I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between microcode and OS patches is an afterthought, and when a new CPU hits the market the numbers are presented without the obvious disclaimer that these performance gains may evaporate within months.

Some even perpetuate the "only relevant to datacenter" myth despite the fact that security researchers have shown to be able to exploit these vulnerabilities with JavaScript in the browser.

pc enthusiasts aren’t really into running javascript either.

I've seen a number of comments like this over the last few days and I don't really get it, gamers use the internet right? Vast overwhelming majority of them are going to be running javascript programs hundreds of times per day

sure, and maybe browsers or os need some way to say “running untrusted code please turn off performance for a sec” for that use case. until then ill just use one tab at a time or disable js before i opt in for slow.

I expect that the vast majority of PC gamers keep Javascript enabled in their browsers.

CS:GO also uses JS for its new GUI, and there's already been one exploit that took advantage of it.

I wouldn't expect that. Is this the kind of thing that would be reported by the Steam hardware survey (if that's still a thing)?

Edit: I took a look and it seems they don't ask/record that info. I apologise for the offence this idea seems to have caused someone.

Nobody was offended by the other. I think people are downvoting you and gameswithgo because you appear to be applying your own personal notions to an entire segment with little to no evidence.

'PC enthusiast' is such a blanket term to start with, so applying a blanket statement to such a group is obviously doomed to failure from the very start.

And that's exactly what the parent did that I replied to. But I do appreciate the explanation, cheers.

Why would steam's hardware survey report if JavaScript is enabled in browsers?

Because its a hardware and software survey. I have a memory of them asking some extra questions but that was years ago. Either I remembered wrong (likely), they changed it, or they don't report it all.

Because downloading and running binaries of applications is much safer?

From what i've seen web browser teams have taken the recent risks extremely seriously - I have sure had a worse track record of infection via downloading and installing software versus visiting sites with JS running

> web browser teams have taken the recent risks extremely seriously

Not really. They didn't even properly apply band-aids.

Chrome and Firefox disabled number of features, that allow Javascript code to create high-precision timers. This makes exploiting slightly more difficult, but the gaping hole is still there — there is infinite number of ways to create a high-precision timer, just not as obvious as closed ones.

Chrome has enabled Site Isolation on desktop, but haven't done it on Android (presumably, because of associated increase in memory consumption).

All major browsers still allow Javascript to run in background, create CPU threads and consume unrestricted amount of CPU time. I don't believe, that any of them have mounted instruction-based defenses (lfence etc.), but I may be mistaken here.

It would be nice if the mitigations could be applied per-core. Then the OS could set the affinity for processes like games that really don't care.

Most places certainly retested CPUs in the wave of Spectre/Meltdown and at least the sources I've seen have mentioned Zombieload/MDS though they've yet to go back and rebenchmark CPUs due to the fact they're either prepping for or travelling to Computex currently. I'd expect most of them to have videos in the next month though.

I'm glad the PC enthusiast space hasn't succumbed to the wild hysteria caused elsewhere by the side channel issues. It's tiresome to see every new variation people come up with reported as a new apocalypse all over again. Half the reason I still pay attention is to find if there's a new Linux boot switch I need to turn on to disable some new performance regression.

Even though I'm personally in the fortunate position not to have any reasonable exposure to these vulnerabilities, I wouldn't be particularly worried even if this wasn't the case. It's been well over a year since Meltdown and Spectre came out and there still hasn't been a single case of anyone successfully using these vulnerabilities to productive ends in the wild that I know of. Obviously, cloud computing vendors need to pay attention and there are legitimate business concerns that are affected by this, but insofar as personal computing goes? If people persist in the ridiculous notion that constantly running completely arbitrary code in naive sandboxes is a great idea, I imagine there will eventually be issues, but so far the issue seems to be vastly overblown in the popular media.

"Wild hysteria", what do you mean? Experts seem to be far from a hysterical, and go for a more technical language, benchmarks and all. And the mass that usually goes hysterical actually doesn't even know their CPUs are going to take a 20% performance hit next OS update, and probably won't even realize that.

The conversation was about the (nominally technical as well as more mainstream) press, not the experts. My remark regarding "wild hysteria" was made in that context. Experts and competent users will do the same thing they always do - evaluate any and all mitigations in the context of the threat models relevant to their usecases and act accordingly. Whether depriving the mass of less technically inclined users of the performance they are used to with all the implications that entails (including for energy efficiency and other externalities) is a wise decision only time will tell.

>My remark regarding "wild hysteria" was made in that context.

Considering we are referring to attacks that can bypass your PC's security, "prudence" is a better word than hysteria.

Yes, if they are left alone, it is the "end of the world".

They can be used to make any modern OS and browser as full of holes as Windows 98.

> Considering we are referring to attacks that can bypass your PC's security, "prudence" is a better word than hysteria.

That statement can be made about any vulnerability whatsoever. The merit of any mitigation can only be determined by a cost/benefit analysis that takes into account the potential impact of the vulnerability as well as the very real costs of mitigating it.

> Yes, if they are left alone, it is the "end of the world".

No offense, but this is exactly why the word "hysteria" seems far more appropriate than "prudence". Not a single one of these vulnerabilities has been used to cause any measurable damage anywhere that we know of, whereas the mitigations deployed have significant costs that everyone must pay. Despite this, emotional "the sky is falling" type pronouncements are far more common in the media - even the ostensibly technical press - than attempts to rationally weigh the costs and benefits of any particular approach to the problem.

>Not a single one of these vulnerabilities has been used to cause any measurable damage anywhere that we know of, whereas the mitigations deployed have significant costs that everyone must pay.

That's like saying: "nobody was drowned that we know of, whereas there was a significant cost to building the dam that everyone paid". (And also not dissimilar to arguments about doing no major industry/lifestyle changes regarding climate change).

It's exactly because there were mitigations relatively quickly deployed that we didn't have a "hack em all" exploit doing the rounds in hundreds of millions of devices. The difficulty of exploiting also gave some leeway to deploying those mitigations.

> The difficulty of exploiting also gave some leeway to deploying those mitigations.

That's putting it lightly. Exploiting Spectre to get private data is difficult. Turning that into a privilege escalation is exponentially harder, so any "hack em all" exploit on hundreds of millions of devices would have needed an entirely unrelated mechanism for spreading.

> That's like saying: "nobody was drowned that we know of, whereas there was a significant cost to building the dam that everyone paid". (And also not dissimilar to arguments about doing no major industry/lifestyle changes regarding climate change).

It is very dissimilar indeed - the sentence you quoted does not constitute an argument by itself. It is an observation regarding the present state of affairs (which you have not disputed), which to me indicates a need to take a breath and do a reasoned cost/benefit analysis as opposed to the hysterical "this must be fixed at any cost, externalities be damned" mindset that is fairly common in many circles.

If you really want a climate change analogy, though, consider this - however many mitigating workarounds you invent, as long as speculative execution exists there will always be side channel attacks, and eventually some of them will probably succeed to some extent. Perhaps, as you noted, some major industry/lifestyle changes are indeed in order - people could stop living in the delusion that a perfect sandbox is possible and realize that arbitrary code execution will always entail risks. Rather than turning every website into a potential security risk, perhaps it is our approach to software (rather than hardware) that needs re-evaluation.

I don't see how the act of taking and publishing measurements after microcode and OS updates constitutes hysteria. It's my understanding, at least on Windows, you pretty much have to opt-out of these patches or manually install an update that disables the mitigations.

I fully support a users right to bypass these mitigations, and you're correct that your typical desktop user, at least today, isn't a target. But it seems odd that websites dedicated to performance computing have a blindspot to how automatically installed updates will impact performance.

> I don't see how the act of taking and publishing measurements after microcode and OS updates constitutes hysteria.

It's quite easy to sensationalize benchmark results even unintentionally. The average reader of PC hardware review sites is totally willing to latch on to a microbenchmark result that shows a 20% performance drop and claim that it's disastrous for performance, even if the actual added delay to real-world operations is a fraction of a millisecond and thus will almost never cause the result of your user input to be delayed by even a single frame. There's a certain degree of irresponsibility in publishing results that you know will be taken out of context by almost everyone who reads them. I've discontinued benchmarks in the past because it was frustrating seeing readers pretend like they show a meaningful difference between products when the reader's workload never comes close to the workload represented by that benchmark.

Did you just make an argument against PC review sites publishing any benchmarks at all because readers can't be trusted to interpret them correctly?

That would kind of defeat the point.

If they published a benchmark in the past and don't bother to correct the benchmark when it becomes out of sync with reality - that is just bad journalism.

Nobody is saying you should go and cherry-pick benchmarks after the mitigations hit, but you should definitely check the benchmarks you already published once.

These sites can and should expect an informed reader.

In any case: Leaving wrong information up uncontested helps neither "experts" nor laymen.

> Did you just make an argument against PC review sites publishing any benchmarks at all because readers can't be trusted to interpret them correctly?

No, and you should know better.

> If they published a benchmark in the past and don't bother to correct the benchmark when it becomes out of sync with reality - that is just bad journalism.

Proper practice is to publish the full test conditions, including software, firmware and nowadays also microcode versions. The availability of newer versions does not make older results any less true.

At AnandTech, we make all reasonable attempts to keep a thorough database of older hardware tested on newer benchmark suites, but the time this requires means we cannot re-test everything multiple times per year. I have over 200 SSDs and counting in the collection, and that test suite is over 30 hours long. The collection of CPUs is much larger. GPU reviews typically have fewer back-catalog hardware entries because updating to new drivers a few times a year is often unavoidable. You can browse the results for current and previous test suites at https://www.anandtech.com/bench/

> These sites can and should expect an informed reader.

You don't read the comments as often as we do.

In the case of my 6850k my overclock was silently killed by the Windows 10 microcode update which locked multi to 38x.

This behaviour angered me no end. I wasted significant time looking for workarounds, and deleting the microprocessor driver was the only way. I wonder what fixes I've now nixed, but there was seriously no need for Intel to kill my overclock.

On a couple of occasions Intel have pushed updates which have reset my fix. Dear $deity .. my next PC will be AMD for sure.

> there still hasn't been a single case of anyone successfully using these vulnerabilities to productive ends in the wild that I know of

Why would the attackers let people know they've successfully exploited?

> Half the reason I still pay attention is to find if there's a new Linux boot switch I need to turn on to disable some new performance regression.

No need, if you really want to disable all mitigations, including future ones, use mitigations=off.

https://www.phoronix.com/scan.php?page=news_item&px=Spectre-...

Thank you, I didn't know about this! Currently still on 5.0 for most of my machines, but this will be helpful once I move to 5.2+.

> I feel like the entire "PC enthusiast" review space has dropped the ball on hardware vulnerabilities. Reevaluating performance between microcode and OS patches is an afterthought, and when a new CPU hits the market the numbers are presented without the obvious disclaimer that these performance gains may evaporate within months.

If you want useful benchmarks that show the performance impact, go to phoronix.

"PC Enthusiast" websites care about gaming performance and single user desktop performance, and always have. This has been the same since I started following things when the fastest CPU available was a 300 MHz Pentium 2. Imagine how amazed we all were by the 1 GHz Slot A Athlon.

Phoronix has multiple articles on the impact of those vulnerabilities, from small laptop to large server processors.

The lament was that the large enthusiast sites are staying hush hush, mostly to not bite the hand that feeds them.

Because Phoronix cares is outside the argument.

The perk of being able to test on Linux is that it's much easier to fully automate testing. Unfortunately, their analysis tends to be shallow.

Their audience is not mainstream but enthousiast And professionals. They do not provide in depth analysis since they probably know the reader can do that for themselves.

That may have been true at one time, but the class of people who would consider themselves to be enthusiasts has broadened well beyond the class of people who can accurately judge how their workload corresponds to the benchmark results they're reading. The recent improvements in the Linux gaming situation have been a big contributor and has undoubtedly skewed the Phoronix audience.

Phoronix serves two important purposes that nobody else does. 1) It serves as a news aggregator for a lot of different open source communities. You'd think that a site called hacker news would do that, but ironically it doesn't. Most content here is either heavily web dominated, or just random drivel about being excellent in life. 2) He runs his standard battery of tests on everything. A lot of upstream projects don't seem to have that much emphasis on performance regression testing. He has uncovered a few regressions and reported them upstream on a few occasions.

I greatly value Phoronix for both of those things; it's a great resource for both my work and personal computer usage. But it does mean that the traditional hardware reviews themselves are something of an afterthought.

It's rumored that companies like Intel and Nvidia will retaliate against review sites and publications for bad press coverage by slowing or cutting off access to preview release products for reviews.

Most of the people who write these articles for review sites do not really understand CPUs in depth. They know how to run benchmark suites and talk about new features mentioned in Intel's marketing material. Most of these people are writers, not engineers. If they were experts they could make a lot more money working at tech companies instead of working for review sites.

In fact, I would bet that most professional software engineers could not correctly explain Spectre, Meltdown, and Zombieload without making at least a few mistakes.

AnandTech is different. They cover μarch, and their writers clearly understand what they're talking about.

Even AnandTech mostly just regurgitates what is feed to them at press events these days.

Anandtech was sold (or maybe Anand left, I don’t recall exactly) about 5-6 years ago. The depth of their technical writing isn’t what it used to be.

Anand left to work for Apple in 2014.

they're still the best in the mobile review space. though that may say more about typical mobile phone reviews than AnandTech.

Anand Lal Shimpi left Anandtech 5 years ago, and the quality articles he wrote have not been replaced. It's basically a tech lite blog now.

I would say Ian is really the only writer at anand i care to read from anymore. His articles always take time to come out compared to everyone else but they at least cover every thing he can think of to tell you about and are well researched

Andrei Frumusanu is also great in the mobile space. The only tech reviewer to run SPEC on phones. Great overviews on the arch of new cores too.

So Despite what I wrote, I still think they are one of the best. Both Ian and Andrei are good with many in depth article, I really do miss Anand's article though. I think, the real problem is Anandtech is short on staff.

Anand has been working in Apple for a few years now, I wonder what has he been up to.

Because intel strictly forbids publishing benchmarks of their processors with the "hardware vulnerability mitigations" applied. Even OEMs cannot show them to their enterprise customers. You can do your own benchmarking after buying the systems. So, no money, no real-world benchmarking.

And you have to abide by those unjust rules because... ?

No free hardware for reviewing, and having to wait until the hardware is available to the general public, so every other site has scooped you.

...you sign a legally binding NDA to be able to early-access the CPUs, test & review them; get the semi-classified technical documents to develop your new servers.

If you don't sign that NDA you can't buy the CPUs from intel to resell them. Even if you are able to buy the CPUs from them, there's no guarantee that you'll buy from the list price or get the discounts for big, prestige projects which require tenders.

It's a deep and ugly rabbit hole.

Intel has never told AnandTech not to benchmark their microcode updates or a third party's OS updates. They haven't threatened to stop sampling CPUs for review. I haven't seen any evidence that Intel has ever attempted to enforce such a restriction against anyone. It's just a stupid clause that one of their dumber lawyers slipped into the EULA text, and does not appear to be something they actually care about at an organizational level or expect to be able to enforce in the real world.

Do you work for Anandtech? If not, what are you basing these claims on? I suspect that Anandtech, etc would not publicly disclose if a hardware manufacturer was forbidding them from benchmarking certain configurations under threat of not releasing samples..

Yes, I write for AnandTech (paid as an independent contractor; I'm not one of the salaried editors). I've done some Spectre/Meltdown regression testing for AnandTech, and I've never been instructed to not do such testing in the future.

Microcode benchmarking is not the hill Intel wants to die on.

Which begs the question, when will we see benchmarks of Intel's CPUs with all vulnerability mitigations on vs. AMDs CPUs?

As soon as the definition of "with all vulnerability mitigations on" stays stable long enough to put together a good review. Benchmarking a moving target is hell, and we don't have enough equipment or staff to do the around-the-clock regression testing that would be necessary to keep our benchmark database current with everything that's happened over the past 1.5 years.

People are using your benchmarks to decide what computer to buy. If they're that out of date, what should I tell them?

To use the best information available, which are estimates on what the potential impact can be, and then make their own decisions.

End-user perceived performance is usually not affected enough to meaningfully change the ranking of products. If a chip goes from being 5% faster to 3% slower when mitigations are applied, you'll never notice that without busting out a stopwatch and digging for a reason to be disappointed. Remember, measurable performance differences aren't always noticeable performance differences, especially without a side by side comparison.

And if two competing processors are close enough in performance for these mitigations to change which one comes out on top of benchmark charts, then other factors like price, power consumption and IO capabilities are probably a much bigger deal at that point than minor CPU performance differences.

Most if not all of our benchmark suites have been updated to include at least the early Spectre/Meltdown/et al. mitigations, and new CPUs are being tested with the microcode they launch with.

I would say putting it in the EULA text is telling you and what's more important, a court of law would probably agree. I don't know why you would expect anything more?

They did for a brief period. It got reverted pretty quickly.

https://www.tomshardware.com/news/intel-cpu-microcode-benchm...

Zombieload is two week old. Testing take time.

And a minute of googling brings up multiple articles about Spectre/Meltdown including two comparisons. https://www.anandtech.com/show/13659/analyzing-core-i9-9900k...

https://www.anandtech.com/show/12566/analyzing-meltdown-spec...

> ... none of these Consumer CPU upgrades interest me anymore

What about the Ryzen 3000 line up? The benchmark leaks make it seem like it is going to be a huge improvement and AMD isn't susceptible to Zombieload.

The problem is I am on Mac ecosystem, which means I don't have much of a choice ( I doubt Apple will ever switch to AMD ) . And since most of my casual gaming are done on mobile, ( I am quite old and don't have time like I used to spent hours on UO or WoW ), none of these upgrade means anything to me. So my interest is in Servers where most of my time are spent now in Web Development.

Apple might switch to ARM, but I think you're right on AMD

This probably doesn't contribute to the conversation but with the number of serious vulnerabilities that have popped up recently I'm not inspired to solve the truth table for the CPU vendor that leaves me the least exposed. As others have said - and I have seen - some of these can be exploited with Javascript in the browser. (I do not know much about Zombieland presently)

Looking forward to a less complex architecture even if it means cutting me off at the knees with execution speed (for a few years):

RISC-V

I remember mentioning before we should have learned with the first Xeon Phis to program microkernels for high core count in-order CPUs.

Because the future is looking increasingly in-order high-core-count with hard partitioning between security contexts.

That's because Anand Lal Shimpi is not doing the writing anymore...

I think the point about the Ice Lake announcement is a mischaracterization.

It's typical for news sites to report individual announcements, with little or no analysis; this is fair, as long as the post clearly specifies its nature (which, in this case, does).

Anandtech did something very interesting actually on the Intel subject, which I didn't see on other sites - it made an article about the performance of the i9-9900k locked at its nominal TDP (95W), which showed very significant losses.

I was put off AT the day I noticed they forgot to cover the Threadripper launch for weeks while they flooded the front page with dry half pagers about new Intel motherboards (not benchmarks mind you, just snippets from the OEMs Press release). I asked about it in the comments and got a boilerplate answer that they strive to present quality articles to the readers.

They also had the Intel series 6 launch where they praised the 6600K and compared it to the 2500K to show “massive” improvements over the years. This while all the other websites noted “minimal speed boost for too big price”. Perhaps both true but the spin on it makes all the difference when showing the intention.

AT shows quite the Intel bias. And it’s not the Intel part that bothers me, it’s the bias part. They go out of their way to make Intel look better without outright lying, just selectively presenting the truth in a way that shines a much better light on Intel. This for me casts doubt on other articles.

I’m glad Andrei Frumusanu’s mobile reviews still have a home, being the best I have seen on the entire internet. But that’s the only segment on AT where I can be reasonably sure about impartiality.

Their October 2018 i9 benchmark review was subtitled "Hardware and Software Security Fixes", and literally began with the following sentence:

The Spectre and Meltdown vulnerabilities made quite a splash earlier this year, forcing makers of hardware and software to release updates in order to tackle them.

https://www.anandtech.com/show/13400/intel-9th-gen-core-i9-9...

its gaming centric news, nobody cares about these exploits when running fortnite

explain why i should care instead of downvoting. a windows program can already just directly look at the memory of other running processes, so why do i care about sidechannel attacks outside of javascript snooping on things which i can mitigate with simple behavior changes.

>>a windows program can already just directly look at the memory of other running processes

Do you run everything with administrative privileges?

Too many programs ask to run as admin already, people just click okay on the UAC prompt to make it go away now.

Benchmarking cpu firmwares is forbidden by the license (same thing for databases)

I would setup a scenario where safety is a concern (V2V) so you could get court order to benchmark firmware.

What licence? You don't have to agree to a licence to use a CPU. I mean Intel might think otherwise, but those kinds of licences("you agree to this licence by just opening the product") are not worth the paper they are written on in EU, so even if there is such a licence it wouldn't be applicable everywhere.

Intel could license the microcode update.

Intel quickly walked back that crap

https://www.tomshardware.com/news/intel-cpu-microcode-benchm...

Anandtech went downhill when they lost Anand. Not sure what the hell he could possibly be doing do that's useful to Apple, but the conspiracy theorist in me wants to think it was Apple getting him out of the media.

Reply on news.ycombinator.com