Hacker News Reader

mitigations=off in the grub kernel options.

You don't need mitigations if you're a server where you control every single running service and application.

You don't need mitigations if you're a HN reader. Do you click on everything randomly and say "yes" to every prompt that pops open?

View on HN

While I mostly agree with that assertion (we do run with mitigations off in our small dedicated devices), there is an important caveat: this only applies if you're 100% positive that you control everything that runs on your box.

If you have _any_ sort of vulnerability in anything that runs on your box and talks to the outside world, that allows for execution of attacker-injected code (even running unprivileged), you're now vulnerable to these speculative execution attacks.

You have to decide how much of a risk you're willing to take in this regard.

Reply on news.ycombinator.com