Hacker News Reader

Comment by dijit | Hacker News Reader

I love that this is a toggle like this, having control of my system is why I love Linux.

But I must caution desktop users against doing this for performance, it's _much_ better to have some kind of build server somewhere else with this kernel flag than to run it on your desktop.

Why? because your desktop executes untrusted and rather arbitrary code pretty often, not just in the form of Javascript but that's the largest example I can think of.

Right now there's a kind of herd immunity for these things, nobody would really attack spectre because everyone is running mitigations, but if you make the target large enough there will be working exploits.

For isolated machines running trusted workloads (thinking: databases or webservers serving static content) then it's a really nice flag to have on-hand.

View on HN

Nice 3rd party toggle for windows: https://www.grc.com/inspectre.htm

Or a Powershell script from MS: https://support.microsoft.com/en-us/topic/understanding-get-...

I'd like some more technical details on what exactly InSpectre does (specifically for the Meltdown patch). e.g. Does it just flip a registry key? Rewrite a microcode patch somewhere? Couldn't find an explanation in the software (even under Show Tech Details) or on their site; could you point me to it?

Also, do all the major browsers now have their own mitigations built in?

Answering my own Question #1: Looks like it sets values for FeatureSettingsOverride and FeatureSettingsOverrideMask under the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" registry key.

FeatureSettingsOverride is a bit field where bit 0 controls the mitigation for CVE-2017-5715 (Spectre) and bit 1 controls it for CVE-2017-5754 (Meltdown). If the bit value is 0 the corresponding mitigation is enabled, if 1 it's disabled. FeatureSettingsOverrideMask is simply a mask to control which bits of FeatureSettingsOverride to apply. So, for example, FeatureSettingsOverride = 2 and FeatureSettingsOverrideMask = 3 would enable the Spectre mitigation (if available) and disable the Meltdown one.

More info here:

https://support.microsoft.com/en-us/topic/windows-server-gui...

https://gist.github.com/daBONDi/6f86210e54c68e84e85372fc4d1f...

Haven't checked if the program emits different behavior for other CPU's or OS versions.

For anyone considering whether to disable these for desktop performance, I tried to do some research on how much it helps, at least for my workload. From what I was able to read, for gaming, the performance differences are negligible. There also seems to be some indication that disabling mitigations is also harmful to performance on more recent CPUs, since more and more of the mitigations are being baked into the silicon.

https://www.reddit.com/r/intel/comments/kp6b6i/how_bad_is_it...

That Powershell script seems to show the current status only, and not have any option to turn the protections on/off?

>desktop executes untrusted and rather arbitrary code pretty often

Aren’t the most affected group of users cloud users (and providers), not desktop users? I thought the biggest risk of specter attacks is the ability to glean information on other server residents who should be segmented off. There are many more concerns in user space which make attacking a desktop with specter pretty cumbersome for low reward wrt opportunity cost.

The performance savings of speculative execution do seem to be worth the risk on a desktop IMO.

Yeah, this is mostly an issue in the cloud where you share SMT threads with other people.

To be more precise, running different cloud customers on different SMT threads of the same core allows them to attack each other.

This is also the case with Spectre-related vulnerabilities such as L1TF.

I was under the impression that spectre is is much more limited in scope than Meltdown. I think you have to be in a position to influence the execution of the program you are trying to extract information from. Like JavaScript engines running in browsers. One example is your JS can be used to get the browser to speculatively execute something that leaks data. I think that it’d be pretty hard for one VM to set up a spectre attack on another arbitrary VM. Meltdown however does expose everything.

At least on AWS EC2, malicious neighbors won't be an issue. "This issue has been addressed for AWS hypervisors, and no instance can read the memory of another instance, nor can any instance read AWS hypervisor memory. We have not observed meaningful performance impact for the overwhelming majority of EC2 workloads."[1]

[1] https://aws.amazon.com/speculative-execution-os-updates/

> for the overwhelming majority of EC2 workloads.

I wonder if that’s weasel words for

“the majority of AWS workloads run single digit cpu utilisation, so a 50% performance hit is not a ‘meaningful performance impact’ for them”?

Phoronix has comprehensive benchmarks on the impact of spectre mitigations if you want to find out how much of a difference it will actually make before exposing your system:

https://www.phoronix.com/scan.php?page=search&q=Spectre

> not just in the form of Javascript but that's the largest example I can think of.

As far as I understand browsers still get owned at every pwn2own. So you might want to stop running untrusted JavaScript anyway.

I'm continually shocked that people are so ok with automatically executing any code random sites they connect to shove at them.

Code is data. Data is code.

Viral bacteria are matter. Matter is viral bacteria.

It's more or less impossible to express recursion (in the same ways you can with js) with pure css/html.

If you want to be overly reductionist then you can argue nothing matters because your just staring at a box with lights in it.

I don't want to go into this topic because frontend developers are very defensive of their capability to Javascript on people, they often cite javascript adoption numbers as proof that it's fine to make it mandatory or cite complex web applications as a reason for it to be mandatory for all sites, which I personally find to be a false dichotomy.

I tend to agree with what you're saying but the ship has sailed very much and running without javascript is a losing proposition these days.

(my web browser starts up with javascript disabled except for some whitelisted sites and it usually only takes 15 minutes for me to find something completely broken on the internet and re-enable javascript entirely).

Nah. I browse the web with NoScript. Snowden himself says to disable scripting in browsers.

Entirely? Use NoScript to temporarily enable only those portions of the single site that you need. No affiliation, just a happy user.

/second NoScript. Instead of whitelisting whole sites, you can whitelist links to JavaScript imports across all sites, temporarily or permanently.

So for example, you can whitelist urls to all the major JavaScript frontend frameworks’ CDNs, like bootstrap, etc. while leaving known trackers and spyware blacklisted by default.

Anecdotally it seems most websites still work with their trackers disabled, as long as they have their frontend framework/s loaded.

I disagree. There are way too many sites that require javascript that you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.

You probably misunderstood : allmost all websites require javascript, yes - but you can selectivly allow only the javascript of that site, their framework etc. and block all the tracker/ads javascript with NoScript/UBlock - and then it is working and probably quite safe. But to mitigate, more and more websites find ways to sneak in the tracker/ads/analytics into the main sites js. So it is not as easy, either.

Which is why I just use basic ublock origin and regulary wipe the browser cache.

>but you can selectivly allow only the javascript of that site, their framework etc. and block all the tracker/ads javascript with NoScript/UBlock

What's the difference between that and just using the standard easylist/easyprivacy filter? I suppose there's a small chance that a third party site went rogue and isn't on the default lists, but I'm skeptical how many attacks that would thrawt in reality. The attacks I heard of tend to be first party/supply chain (would be white listed by you), or delivered through an ad network (probably already be on a blacklist).

Easylist and Privacylist are great. I suppose the main reasons for doing it manually are seeing firsthand what all the sites you visit are doing behind the scenes, and getting a sense of what is legitimately needed functionality, what isn't, and what is just downright sketchy.

Yup. But you can only do this when you have time for it. I kind of got very pragmatic with it.

I've been using noscript for at least a decade and it hasn't happened yet. I have conditioned my wife to use it too. She doesn't do it either

So what happens if you go to a site and see a blank/broken page? Do you just go back and abandon the page? Do you do a full risk assessment of each of the domains? What does that assessment entail?

First I curse JavaScript developers (sorry). Then I use a heuristic like is this a real website for a real thing that I heard of before today, then temp trust; if it’s click baity or new, don’t trust or try adding in one at a time or mostly just give up. Very little shortage of content.

Depends. Sometimes I leave immediately, other times that blank is just a cover on top of content. And finally, I sometimes have to enable a domain/subdomain using common sense.

It's not that hard, nor time consuming. Again, my wife can do it and she's not a developer.

Still though. There are sites that would not work at all until everything is enabled, including ads. Imagine not being able to buy a plane ticket because wizzair wants to serve you ads

I disagree. I'm not just pulling this out of my ass, I've been doing exactly this for years, I can't remember how long. It works fine.

>you'll eventually get into the habit of blindly enabling scripts when a site breaks, negating any security benefits.

The key here is that when you're deciding whether to whitelist a JS import, and you don't know what it is and don't want to take the time to look it up, then whitelist it temporarily not permanently. It will be moved back to the blacklist the next time you restart the browser.

Only permanently whitelist JS that you know for sure isn't a tracker or malware or sketchy.

> Only permanently whitelist JS that you know for sure isn't a tracker or malware or sketchy.

What’s the whitelist based on? URI? Or file content hash? Because today’s “criticalsitefunctunality.js” is tomorrow’s “upstream got p0wned and there’s a Bitcoin miner in there too now”.

Sites churn so often that “permanently” whitelisting hashes is probably a never ending chore, and you’re unlikely to want to constantly re-inspect minimized JS, so this eventually turns into semi-blind faith.

And permanently whitelisting URIs is pure security theatre; that file could contain anything, next request.

I'm aware of all that, but it's not theater, it's just part of a defense in depth strategy. Reduces attack surface area, doesn't eliminate it, while maintaining usability of the web.

If you have a better approach that accomplishes both of those objectives, do tell.

I'm sure it adds some amount of security. I'm just skeptical it adds enough security to be worth the hassle. I discussed the threat model here: https://news.ycombinator.com/item?id=27564457 and came to the conclusion that it wouldn't prevent much attacks in practice.

> If you have a better approach that accomplishes both of those objectives, do tell.

Use a browser that isolates the JS engine in its own process and leave spectre mitigations enabled rather than try to play kid-plugging-holes-in-dike-with-finger by auditing all the world’s constantly-changing JS for spectre/meltdown gadgets?

>Use a browser that isolates the JS engine in its own process

Definitely. All for that.

>and leave spectre mitigations enabled

I do that anyway. The performance cost is unnoticeable to my normal workloads.

>rather than try to play kid-plugging-holes-in-dike-with-finger by auditing all the world’s constantly-changing JS for spectre/meltdown gadgets?

I'll continue doing this too, largely because I want to see what's going on behind the scenes on all the websites I visit. Useful for me to see it all, especially as it changes over time as you observe.

That said, Easylist and Privacylist are also great if you'd rather crowd-source the finger-in-dike-hole-plugging.

I used to do this. It broke too often when doing credit card purchases though... it would take multiple attempts to complete a purchase and figure out which domains needed to be enabled. Sometimes the status would be left ambiguous. Once I double-spent, but fortunately it was a cancellable reservation. I suppose you can do better if you just spend at a few key sites.

>it would take multiple attempts to complete a purchase and figure out which domains needed to be enabled.

Yeah I went through this too, figuring out all the CC purchase redirects. Some are just idiotic to the point I wish govts would pass a law mandating zero redirects for online purchases. Stripe, Paypal, Square, Braintree and a few others do payments just fine without the redirects so it's clearly possible.

But eventually even that gets solved and the redirects get whitelisted. Haven't encountered this problem for a long time.

Simply "enable all" for pesky cases like that.

I have used NoScript for over a decade and I've been bitten by this too, but I've noticed that it has gotten better. CC processors seem to have encountered enough crappy browsers and broken JS implimentations that they've improved their services in the last half dozen years or so.

That said, when there's something old, important, and/or dumb looking, I usually spawn a new Firefox container (using Multi-Account Container plugin) and use NoScript's temporary bypass function.

I do it with uMatrix. I usually go up to the "all sites" level and enable most everything before going through a credit card payment flow, for this reason.

Security is only part of my motivation, though, and not the main part -- I mostly do it because it protects me by default from all the pop-up type crap that so many websites foist on you. Yes, it's a pain to un-break sites sometimes. But I resent it less than going through the equivalent pain in "privacy settings" popups, wriggling chat widgets, "ate you sure you don't want to sign up for our newsletter?" nags, etc. Websites are already broken; as long as that's true, I'd rather be in control of why.

I feel that is a bit like driving blindfolded because you might get distracted at some point anyway. Sure that one script you have to enable might be the one to exploit your system, but it might also be one of the dozens that didn't do anything useful.

uMatrix by uBlock Origin too.

I use a browser called Qutebrowser which doesn't have a noscript addon; but I can disable javascript loading on a domain level.

However, overall I can tell you for absolute certain: if you have JS partially disabled things break in non-obvious ways and I find myself playing whack-a-mole with allowing various domains to load javascript to get the page working.

I'm pretty certain you do also, because it's basically impossible to tell why certain damned sites are broken and the most obvious thing to do is just enable JS temporarily to see if it works at all.

This is especially annoying on some part of a site such as checkout- where reloading the page causes a form resubmission.

I like this breakage because it makes me unhappy with the website and less likely to use it -- the immune system is working as it should.

That's probably a good approach for random news sites and such, much less so when your internet banking and even online shopping sites require JS on.

If the actual payment is via Paypal I think it usually works without JavaScript in the merchant. And like content, there is no shortage of places to buy stuff.

For banking i use their phone app or else visit them in person. But I use a credit union not a bank as I want to trust the people holding my money.

> I love that this is a toggle like this, having control of my system is why I love Linux.

You can disable mitigations on Windows too.

Yeah but the next update will probably turn it back on silently...

Unlikely; Windows updates (mostly) only turn things you disabled back on if they're harmful to you.

Yeah: and disabling mitigations for an attack certainly wouldn't be considered "harmful" by anyone.

idk about this, my anecdotal experience suggests otherwise - irrelevant things (i.e., monitor resolutions, mouse acceleration curves, and I think DNS settings at one point) can be thrown around by updates a bit too frequently in my experience.

I have a tablet that was unusable before I installed WuMgr and blocked auto-updates because every 24 hours Windows Update would force-install a broken touchscreen driver. Windows Update is the single most embarrassing, half-assed software project of the 21st century.

your desktop is already rooted by Zoom

Seriously. I hate zoom, there are so many features that smell like malware (how when a call starts sometimes my system level volume no longer is controllable and I have to go to zoom settings to control it. I have windows+wsl, but it's happened on macs in my company as well). Google gets a lot of hate, but I like their meeting tool because they keep it simple and it works.

I just changed company. Wish I could go back to Zoom. Google Meet is horrible. I have to open Chrome for all meetings, as it (probably intentionally) runs worse in other browsers. But even in Chrome there are issues. Some workloads (like running tests) can take 5x as long on my system if I'm sharing my screen on Meet. Making working with others more hassle than it should be.

This is fair, but at least you're sure that when you close the window that it's gone and that is as far as I'm concerned its biggest feature. Oh, and that it seems to work well on all platforms.

“Close browser tab” - immediately exits a Google Meet.

Closing a Zoom/Webex meeting, who knows since it’s still running in the background.

I also like meetings sandboxed in a browser so weird things like “automatically take control of your screen and maximize window” doesn’t happen when someone in a Zoom meeting starts sharing their screen.

Even at the expense of more CPU.

> “Close browser tab” - immediately exits a Google Meet.

How would you know? Or, put another way: Why don’t you want to trust Google Meet, but apparently want to trust Google Chrome?

Meet isn't much integrated into Chrome, so absent a Chrome bug, closing Meet stops running Meet code, so stops the meeting. “Closing” Zoom relies on Zoom detecting the closure and stopping the meeting.

It's not about spying from the software authors (having these softwares on your computer makes that impossible to defend against), but about knowing whether the people you were just talking to still have access to your camera and microphone feeds.

> Meet isn't much integrated into Chrome

Again, how would you know that? There is no reasonable way you could possibly know that.

That meme with the actor taking to a bloodied Jesus comes to mind while reading you guys comparing google with zoom. You guys are so lucky. I work on Skype for Business over a Citrix Workspace connection.

While Skype is an unmitigated disaster that can’t do simple stuff like copying text there is Citrix that requires a wizard installer with admin rights that deploys 3 background services and requires an audio plugin (separated, with another wizard installer) to do a worse remote streaming experience than what discord does for teenagers using a browser.

Since you are on Skype for Business I'm going to assume you are not using Teams currently. Teams is actually a lot worse in almost every way than SfB when it comes to the functions both systems share.

> While Skype is an unmitigated disaster that can’t do simple stuff like copying text

Do you mean from shared contents or from the chat? The latter works for me, but since you also mention using Citrix Workspace, which sounds like a remote desktop/application tool, it seems likely to me that this is actually the fault of Citrix, not Skype. Remote clipboards seem to be rather unreliable, I'm using DCV 2017 and the clipboard breaks basically every five minutes, necessitating a reconnect.

Sometimes you copy what you want sometimes you copy the message with the metadata and sometimes copy doesn’t work. Pasting stuff from other sources will cause some weird table elements to appear. There is no way to format code. Sometimes it says the message is too big but then you paste the same message into notepad and copy paste again it works just fine. The text editor and visualization seems to be arctifacts of a bygone era where everything was rich text.

I’m not sure if it’s the clipboard because my employer does not allow shared drives, clipboard, usb or any resource from my local machine except for mic and webcam.

Ohhh and let’s talk abou the HUGE black ribbon at the top of the screen when you are sharing your window. It totally covers the browser tabs. You have to restore the window and switch tabs and maximize it again. It _is_ an unmitigated disaster that degrades the overall experience.

The inability to copy text may be due to an admin setting. At my previous workplace they disabled the ability to paste in images, etc. into Skype for Business saying that it was a security risk. They also disabled the ability to copy and paste between apps except within MS Office for the same reason.

It's not Citrix doing this, but your administrator.

Copy and paste works. They did disabled any communication between the client machine and the Citrix VDI except for audio and camera but the feature I'm complaining about is within the Remote Desktop. It works but its random and terrible. Sometimes you try to copy a single word but it copies the entire message along with the metadata containing sender and timestamp.

There has never been a webmeeting software that people didn't bitch about constantly. They all suck, because, fundamentally, what they are trying to accomplish sucks. Nobody wants to do audio/video meetings, we just suffer through them because we have to.

Same as bug tracking software.

We had Zoom at our workplace for longer than most people knew what it was and I still have not installed it on my own PC. If I don't need to have myself on video, I run zoom on the work machine I'm remoted into and use my phone for the audio. If I need to use video, I use the application installed on my iPad since I trust that it's even more sandboxed than my Android device. I would rather not have the application installed on any of my personal devices, but that's the closest I can get when it comes to keeping Zoom away from my stuff.

Huh. I had this happen on Linux, too. I chalked it up to PulseAudio getting lost with my multiple sound cards and connecting / disconnecting peripherals.

And teams. And all that software that you used to be able to use that you have to make exceptions for so that in the end you end up forgetting to re-enable some critical part of the windows scareware implementation.

Seriously: try installing Firefox on Windows 10 (I had to do this recently, I have now one computer in the house on Win 10 due to a hard requirement for some software/hardware combo), and you'll see Microsoft learned next to nothing from the browser wars lawsuit. They're simply asking to have this done to them again, they now actively discourage Firefox to be installed by claiming it can 'damage your computer' and is insecure. Incredible this stuff.

Oh, and Google will return a link for Chrome as the first item when you search for Adblock for Firefox. You can't make this stuff up.

Has there ever been a large company in IT that didn't turn absolutely evil as soon as the opportunity presented itself?

I run Windows 10 (Home) since years and the OS has so far, never tried to warn me about Firefox. It does however reset default browser back to Edge after biannual major OS upgrades. Also searching 'adblock for Firefox' on Google returns several results from Mozilla addons for me. Chrome is not linked anywhere on the first page of results.

What is personally more annoying is Edge keeps randomly popping up a banner asking if I'm sure it shouldn't be the default browser. When a user declines once, the OS shouldn't nag repeatedly.

"When a user declines once, the OS shouldn't nag repeatedly. "

Haha, ... when you apply that standard to the modern world - you sometimed wish the stoneage back.

Seriously, there is something deeply wrong with society, when all this shit just gets accepted by everyone.

"Telemetry" such a innocent word. If they would write we record allmost everything you do on your computer and send that data to wherever we want to .. I doubt much would actually change, as MS office software is still mandatory in many places, but maybe there would be more awareness of it.

> Has there ever been a large company that didn't turn absolutely evil as soon as the opportunity presented itself?

No?

>Oh, and Google will return a link for Chrome as the first item when you search for Adblock for Firefox. You can't make this stuff up.

Maybe your profile affects results, here:

"Adblock for Firefox"

returns

"https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/"

"adblock"

returns 1st url = https://adblockplus.org

2nd url is = chrome.google.com

> You never sent me a response on the question of what things an app would do that would make it run with MS-DOS and not run with DR-DOS. Is there [a] feature they have that might get in our way?

Bill Gates

> What the [user] is supposed to do is feel uncomfortable, and when he has bugs, suspect that the problem is DR-DOS and then go out to buy MS-DOS.

MS SVP Brad silverberg

> If you're going to kill someone there isn't much reason to get all worked up about it and angry. Any discussions beforehand are a waste of time. We need to smile at Novell while we pull the trigger.

MS VP Jim alchin

What has changed? Nothing, of course. Settling and paying fines for blatant abuses of dominant market positions has been Microsoft’s MO for decades.

The behaviors described here are intrinsic to capitalism, and are not peculiar to any individual company. The executives quoted here are simply describing the waters they swim in. But they are only one fish in the sea that is liberal governance. The system is the problem, not Microsoft.

This system will cause any publicly traded company to behave like a sociopath and limit career paths for non-sociopaths who are unwilling to break (or bend) the law to further their agendas.

With growth hacking it seems that all the it companies that get big now were evil when they were small, too

I just setup 2 laptops this week on Win10 Pro, inatlled Firefox and Chrome, and nowhere did it mention anything about Firefox being bad?

Maybe a Win10 Home, or some other version? Or was that in a search result (or ad) not actually Windows?

Give it time; it's a trickle campaign. Just this morning I updated my Win 10 Pro desktop, and on reboot I got a full screen wizard prompting me to "use recommended browser settings" which is doublespeak for changing my default browser to Edge.

Edit: On re-reading, I believe OP was specifically referring to false positives with SmartScreen that crop up regularly, like at https://www.reddit.com/r/firefox/comments/n7gige/ms_edge_blo...

The SmartScreen stuff is a plague that applies to all software developers in varying degrees. Chrome does this with their safe browsing stuff too, I hate it - essentially everyone gets told your exe is "malicious" until enough people have downloaded it without it being flagged as malware.

The idea that it applies to trusted vendors like Mozilla shipping code-signed executables is bonkers to me.

Nice way to promote further centralization into services like app stores that don't suffer from this!

You can disable SmartScreen with O&O ShutUp10 [1] on the home version.

[1] - https://www.oo-software.com/en/shutup10

> Give it time; it's a trickle campaign. Just this morning I updated my Win 10 Pro desktop, and on reboot I got a full screen wizard prompting me to "use recommended browser settings" which is doublespeak for changing my default browser to Edge.

Yeah, I actually think this is a case of "don't explain by malice that which could be adequately explained by stupidity" or something.

I'm only a casual Windows user (only use for it games) and never bother to install another browser, Edge works well enough to download Steam and occasionally look up something on the internet.

Earlier this week when it installed the new update I also got the same "use recommended browser settings" dialog box. I think I had disabled 3rd party cookies or something as well as the random junk on the new page, so not willing to click around for half an hour I denied using anything and all went well. I'm pretty sure this isn't the first time I see the "use recommended settings" on this PC, since seeing it gave me an "again?!" reaction.

This is a Win10 Pro that's always been kept up to date.

" Has there ever been a large company in IT that didn't turn absolutely evil as soon as the opportunity presented itself?"

I like nuances, though. "absolute evil" is a bit strong.

There were companies who were engaged with enslaving people and working them to death. (some still are)

I am no fan of googles development, but absolute evil leaves no room to describe other companies who are actually worse.

> some still are

well that's an understatement[0].

I alos think it's less productive to interpret the phrase absolute evil as a comment on an entity's moral alignments (because it's a corporation, it's not chaotic evil or neutral good, it just is) but as a comment on the foundation and effects of the economic and political systems defining of the corporations (capitalism under neoliberalism). Absolute evil seems like a fairly decent personification of those metrics to me: every extra push to manufacture another product pushes us closer to a climate catastrophe (even 'green' products like Teslas, especially green products like Teslas[1]). Even if you deny climate change, you can't deny that workers are being taken advantage of near habitually. If we're going to personify the destruction of the earth and the worker, absolute evil does not seem too far off.

0: https://en.wikipedia.org/wiki/Foxconn_suicides for one 1: https://www.wired.com/2016/03/teslas-electric-cars-might-not...

There is still a big difference, between exploiting people - and owning people - and literal doing what you want with them. Flock them. Burn them. Rape them - as you please. This is slavery as it used to be (and partly still is!!). And that term gets watered down when applied to something else.

Exploiting people because they are desperate is a big problem. Maybe call it modern day slavery. But it really is not the same as what slavery means for people who are literaly and 100% owned by others.

> Microsoft learned next to nothing from the browser wars lawsuit.

That's been true since the very beginning.

I very nearly filed papers to oppose class council in one of the state lawsuits on the basis that the proposed settlement was calculated to create a new antitrust injury to the class.

But I didn't because I was young and pro se and there was no way for me to afford or find representation. If I had to do it again I would've filed pro se requesting that they reject the settlement on that basis and appoint a guardian ad litem to roll the dice anyway.

> Has there ever been a large company in IT that didn't turn absolutely evil as soon as the opportunity presented itself?

If turning evil increases shareholder value, it’s their fiduciary duty to do so.

> If turning evil increases shareholder value, it’s their fiduciary duty to do so.

Meh. Maybe not: https://medium.com/bull-market/there-is-no-effective-fiducia...

Just because it's rooted by 1 or 20 companies it's not reason to open it up to any random person on the internet.

> I love that this is a toggle like this, having control of my system is why I love Linux.

The need to keep telling this loud and clear for the manufacturers to hear is more needed now than ever since computers are becoming closed systems like smartphones and Manufacturers are claiming 'Customers not having to make hard decisions' to do so.

Kind of feels like apps should opt in to (or out of) mitigations individually. Obviously a web browser needs it, but does Clang? VSCode? Zoom? Probably not.

Three main things here:

1) we can’t trust people to categorise their own apps because the incentive for performance over security is a trade off we’ve all made time and time again.

2) efforts to address mandatory access controls have a coloured history here: selinux and apparmor both have very low adoption rates no matter your personal anecdotes.

3) These mitigation’s are so thorough that it would be more expensive on performance to even _check_ per application than it would be just to enable it everywhere.

I don't think that (3) is true.

How would you implement such a change?

Considering that you have:

A) some list of allowed applications/programs

B) a run of this check on every syscall

C) to be faster than a TLB flush

I don't know but I can't imagine a highly predictable branch being slower than a TLB flush.

Well consider the fact that checking a table of “ok” programs is a branch and a lookup in of itself.

Yeah that should be really fast, still. Programs could also opt to just tell the OS "hey don't check this system call from me", on each system call, avoiding any lookup.

The impact of TLB flushing, not just the cost of the flush, is really significant - it's going to take a lot of work to be as expensive within the syscall path.

What would stop malware telling the os to not check it?

Nothing, but that only makes reading the malware's memory possible with these exploits. That malware won't be able to access memory of some other process, if that other process is using those flags itself.

Edit: For that to work that flag would have to work on the context switch level. So every time you switch away from a sensitive process, flush all buffers and whatever else, then switch. This also requires the kernel itself to enable mitigations as necessary when it touches encryption keys before switching back to user space.

That assumes that the malware can already have arbitrary control over system calls, at which point spectre isn't the issue.

It would be a branch, but surely it would be a flag on the process struct set when the process started, rather than a lookup each time.

Didn't browsers implement their own mitigations? Or were those only for some vulns?

Vscode is a browser

As in "it runs JavaScript and renders HTML", yes. As in "it runs stuff in a security sandbox", no.

How about extensions? I would have thought these amount to a comparable security concern as web pages. Do they have adequate isolation?

No, extensions are fully trusted. They can do anything.

Just require everyone evil to set the evil bit, and everything would be much easier.

Reply on news.ycombinator.com