Hacker News Reader

Comment by ye-olde-sysrq | Hacker News Reader

So are Ryzen 5000's without Radeon not vulnerable? I guess said processors are zen 3?

I have an "AMD Ryzen 9 5950x Desktop Processor" which appears to be Zen 3. I think I'm good?

(Not that I'm running untrusted workloads, but yknow, fortune favors the prepared)

You are likely frequently running untrusted workloads. As javascript in a browser. I don't know about this one, but at least meltdown was fully exploitable from js.

But yes, you are fine, 5950x is Zen3.

I was under the impression that 5600g and 5600u were Zen3, but being the APU models they have Radeon graphics.

Anecdotally, I tried to reproduce on my 5600g but couldn't. Which is surprising because they claim it works on 5700u...

Edit: just discovered that while my 5600g is Zen3, the 5700u is Zen2. Lol.

Your point is valid, but the processor in question is a server, so actually no js being run :).

I wish Firefox would use PR_SCHED_CORE to reduce the likelihood of such leakage...

The idea being that the main process and content processes should never be on the same core?

I would worry about cross site leakage. From my understanding that would be unavoidable as soon as you have more tabs open than cores, which feels like an unworkable restriction.

Imagine opening a 9th tab and bring told you need to upgrade your 3700X to a 3900X.

I think there's several levels. As a first step, I'd appreciate reducing the risk of javascript extracting contents from outside the browser. A second step could be to use more granular core scheduling within firefox, to prevent sharing cores that shouldn't be shared. A process/thread hierarchy can create multiple core scheduling groups.

>As a first step, I'd appreciate reducing the risk of javascript extracting contents from outside the browser.

But that means essentially reserving a core for the browser only. I don't think that would be shippable by default.

Reply on news.ycombinator.com