Hacker News Reader

Comment by esaym | Hacker News Reader

I've given up tracking this stuff. Just been adding https://make-linux-fast-again.com/ to my grub configs everwhere.

Even if you are OK with using that on a machine, that list of options absolutely reeks of magical thinking. On a modern Linux, a simple "mitigations=off" is equivalent to more than half of the other options listed, and many of the remaining listed options don't seem to exist anymore.

Like how some people still advocate for wiping hard drives with the Gutmann method (35 wipe passes)[0] when a single pass is more than sufficient for practically everyone?[a][b]

[a]: Obviously, for absolute security, a hammer and/or a shredder does much better.

[b]: This also ignores that the Gutmann method was designed for hard drive encoding methods that aren’t used anymore.

[0]: https://en.wikipedia.org/wiki/Gutmann_method

Method A is also known as "Widlarizing" or the "Widlar" method. "How do you Widlarize something? You take it over to the anvil part of the vice and you beat on it with a hammer, until it is all crunched down into tiny little pieces, so small that you don't even have to sweep it off the floor. It sure makes you feel better. And you know that component will never vex you again." Bob Pease, describing Bob Widlar's method for dealing with broken electronic components.

> [a]: Obviously, for absolute security, a hammer and/or a shredder does much better.

This still leaves large pieces of magnetic plates intact. At uni we could read some data from floppies that went through shredder.

Hammer and shredder is NOT "absolute security".

1.44 MB 3.5in floppies had 17434 bpi. Hard disks apparantly have around 1 Tbpi. That's like saying it's possible to jump to the moon because you could do a slam dunk back in school. You're probably still right, though. https://www.anandtech.com/show/11925/western-digital-stuns-s... https://en.m.wikipedia.org/wiki/Disk_density

Unfortunately e.g. the RHEL 7 world doesn't have mitigations=off yet (in addition to many other kernel command line sugars).

It's intended to be a catch all for multiple kernel versions. The 'mitigations=off' option was introduced with version 5.2.

https://www.phoronix.com/scan.php?page=news_item&px=Spectre-...

I would much rather have liked to see a list of kernel versions with customized options for each.

I mean, imagine coming upon a system where you want to add some other kernel option. You see that the system has all those options already added to the default kernel options. Are you going to research and clean up those options and remove the irrelevant ones? Or are you going to punt, add your own option to the end, thereby adding to the chaos?

I'm the author of the website - I keep the whole list because older kernels didn't have mitigation=off, and inexisting options won't prevent your system from booting.

Please, not in production systems

Why not?

Or do you mean "please, not in a production system where you share a host"?

If that's the case, I think you have it backwards. In production, please, don't share a host.

There’s zero reason to change 8 digit passwords every 6 months if your /etc/passwd isn’t insecure

Related: does anyone know how good current browsers are at mitigating Spectre-related attacks through JavaScript? It's hard to run a browser on the modern Internet without at least running _some_ untrusted JS.

Turning off the mitigations in the kernel sure speeds things up a lot on older machines, but if browsers don't do a proper job of mitigating those attacks then someone could extract data through JavaScript.

Reply on news.ycombinator.com