Retbleed fix slugs Linux VM performance by up to 70 percent

theregister.com

14 pointsLinuxBender3 comments

Is it even possible to have speculative execution and not being vulnerable to related exploits?

mitigations=off in the grub kernel options.

You don't need mitigations if you're a server where you control every single running service and application.

You don't need mitigations if you're a HN reader. Do you click on everything randomly and say "yes" to every prompt that pops open?

While I mostly agree with that assertion (we do run with mitigations off in our small dedicated devices), there is an important caveat: this only applies if you're 100% positive that you control everything that runs on your box.

If you have _any_ sort of vulnerability in anything that runs on your box and talks to the outside world, that allows for execution of attacker-injected code (even running unprivileged), you're now vulnerable to these speculative execution attacks.

You have to decide how much of a risk you're willing to take in this regard.

Reply on news.ycombinator.com