Yeah. Then these geniuses get bitten by Spectre/Meltdown because they were too scared of running the microcode update. For real.
I agree, if that's the position of Guix, I don't want it in my machine.
I agree, if that's the position of Guix, I don't want it in my machine.
It had to be fixed, but your thesis that anyone was actually owned by these security issues because they didn't want to apply the mitigation rounds to at most 0.0% with an infinite amount of zeros before a 1.
The "nonguix" channel mentioned in the article does have Intel and AMD microcode for users who want it. This is similar to Debian, where you have to opt-in by enabling the "nonfree" repository and "apt install" the microcode package corresponding to your CPU.
> where this Linux fork actively removes security warnings informing users that they need to update their CPU microcode
Is not ok
https://news.ycombinator.com/item?id=29290087
...at least, I don't see any such code in the actual deblobbing script: https://linux-libre.fsfla.org/pub/linux-libre/releases/5.15....
edit: since you called linux-libre a "fork", I feel compelled to point out that Linux-Libre is just the vanilla Linux kernel with that script applied. No more, no less.
# Do no recommend non-Free microcode update.
announce X86_LOCAL_APIC - Undocumented
clean_blob arch/x86/kernel/apic/apic.c
clean_kconfig arch/x86/Kconfig X86_LOCAL_APIC
clean_mk CONFIG_X86_LOCAL_APIC arch/x86/kernel/apic/MakefileLibreJS is a good example in order to kill any potential Spectre/Meltdown attack. There is no attack when no code is being run.
Can you buy anything at all on the internet?
If attackers who cannot add a comment to their exploit are in your threat model.
Personally, I've been using a browser extension that blocks JS unless it has a comment reading
> This code is NOT evil or malicious!
at the top. Haven't been hacked yet!
https://9to5mac.com/2021/03/11/browser-based-attack-affects-...
Turns out you don't need Turing completeness to perform microarchitectural side channel attacks. This is yet another way in which the "all my software is free, therefore I am safe from attacks" fallacy breaks down.
Nevermind that, as pointed out by other replies, LibreJS provides zero security. It relies on scripts voluntarily declaring that they're freely licensed, and if they do, they're allowed to run. The extension doesn't care whether the script is malicious or not.
I am still safe.