<story><title>Make Linux Fast Again (2019)</title><url>https://make-linux-fast-again.com/</url></story><parent_chain><item><author>pantalaimon</author><text>Don&amp;#x27;t browsers fudge the accuracy of the available clocks already to mitigate SPECTRE?</text></item><item><author>danShumway</author><text>To be clear, SPECTRE leaks privileged memory at an OS-level -- up to in some cases allowing arbitrary virtual memory reads.&lt;p&gt;While Javascript is the most likely attack vector for most people, you should not use this command on a system that&amp;#x27;s running untrusted code from anywhere in any context, and you should consider moving sensitive information like passwords off of the computer.&lt;p&gt;I use uMatrix to disable Javascript by default on every site I visit, and I still would not feel safe running this command on anything other than a single-purpose device.&lt;p&gt;That&amp;#x27;s not to say that there would &lt;i&gt;never&lt;/i&gt; be a good reason to run it. A very imprecise, easy test I would propose is, &amp;quot;is your Linux system vetted enough or just unimportant enough that you would feel comfortable getting rid of users and running all of your software as root?&amp;quot; In which case, SPECTRE &amp;amp; friends is probably not a credible threat to you on that machine.</text></item><item><author>jcelerier</author><text>Yes, that&amp;#x27;s the point of this site - if your workflow is hurt by the perf impact of mitigations and SPECTRE &amp;amp; friends are not a credible attack, for instance because you disable JS by default, then you can just curl and pipe this to your kernel parameters</text></item><item><author>miles</author><text>The GRUB parameters that appear on Make-Linux-Fast-Again.com apparently disable Spectre&amp;#x2F;Meltdown mitigations:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;rizalp&amp;#x2F;ff74fd9ededb076e6102fc0b636bd52b&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;rizalp&amp;#x2F;ff74fd9ededb076e6102fc0b636bd...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;securitronlinux.com&amp;#x2F;bejiitaswrath&amp;#x2F;how-to-get-a-nice-speed-boost-for-ubuntu-this-really-does-work-well&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;securitronlinux.com&amp;#x2F;bejiitaswrath&amp;#x2F;how-to-get-a-nice-...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.phoronix.com&amp;#x2F;scan.php?page=news_item&amp;amp;px=Spectre-Meltdown-Easy-Switch-52&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.phoronix.com&amp;#x2F;scan.php?page=news_item&amp;amp;px=Spectre-...&lt;/a&gt;</text></item></parent_chain><comment><author>danShumway</author><text>I would appreciate someone else who knows more than me about the current state of these attacks and more than me about Linux security in general answering this question. Take what I&amp;#x27;m about to say with a grain of salt.&lt;p&gt;My understanding is that Firefox still reduces timer accuracy, Chrome &lt;i&gt;did&lt;/i&gt;, but increased timer accuracy again after adding other protections. I&amp;#x27;m not sure if Chrome&amp;#x27;s protections rely on Meltdown vulnerabilities being patched on the OS level or not. It&amp;#x27;s been a while since I checked back on what the status was there, so I might be wrong.&lt;p&gt;There are also some concerns about shared memory buffers, which is why I think some of the features around them haven&amp;#x27;t been enabled in WASM yet. I haven&amp;#x27;t checked the status on that stuff in a while either.&lt;p&gt;In any case, for a vulnerability of this scale I bias towards saying people should practice defense in depth. Sometimes browsers have bugs in them, and this would be a particularly bad one. And again, there are userland native apps and systems and package managers that people need to worry about that go beyond browsers.</text></comment>
<story><title>Make Linux Fast Again (2019)</title><url>https://make-linux-fast-again.com/</url></story><parent_chain><item><author>pantalaimon</author><text>Don&amp;#x27;t browsers fudge the accuracy of the available clocks already to mitigate SPECTRE?</text></item><item><author>danShumway</author><text>To be clear, SPECTRE leaks privileged memory at an OS-level -- up to in some cases allowing arbitrary virtual memory reads.&lt;p&gt;While Javascript is the most likely attack vector for most people, you should not use this command on a system that&amp;#x27;s running untrusted code from anywhere in any context, and you should consider moving sensitive information like passwords off of the computer.&lt;p&gt;I use uMatrix to disable Javascript by default on every site I visit, and I still would not feel safe running this command on anything other than a single-purpose device.&lt;p&gt;That&amp;#x27;s not to say that there would &lt;i&gt;never&lt;/i&gt; be a good reason to run it. A very imprecise, easy test I would propose is, &amp;quot;is your Linux system vetted enough or just unimportant enough that you would feel comfortable getting rid of users and running all of your software as root?&amp;quot; In which case, SPECTRE &amp;amp; friends is probably not a credible threat to you on that machine.</text></item><item><author>jcelerier</author><text>Yes, that&amp;#x27;s the point of this site - if your workflow is hurt by the perf impact of mitigations and SPECTRE &amp;amp; friends are not a credible attack, for instance because you disable JS by default, then you can just curl and pipe this to your kernel parameters</text></item><item><author>miles</author><text>The GRUB parameters that appear on Make-Linux-Fast-Again.com apparently disable Spectre&amp;#x2F;Meltdown mitigations:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;rizalp&amp;#x2F;ff74fd9ededb076e6102fc0b636bd52b&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gist.github.com&amp;#x2F;rizalp&amp;#x2F;ff74fd9ededb076e6102fc0b636bd...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;securitronlinux.com&amp;#x2F;bejiitaswrath&amp;#x2F;how-to-get-a-nice-speed-boost-for-ubuntu-this-really-does-work-well&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;securitronlinux.com&amp;#x2F;bejiitaswrath&amp;#x2F;how-to-get-a-nice-...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.phoronix.com&amp;#x2F;scan.php?page=news_item&amp;amp;px=Spectre-Meltdown-Easy-Switch-52&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.phoronix.com&amp;#x2F;scan.php?page=news_item&amp;amp;px=Spectre-...&lt;/a&gt;</text></item></parent_chain><comment><author>saagarjha</author><text>Yes, but this doesn’t actually fix the issue; it just makes exploiting it harder. Fundamentally, even if you fudge clocks you can still average out things with enough measurements, and if you remove all of them you can busyloop and count iterations of &lt;i&gt;that&lt;/i&gt; instead as a “timer”.</text></comment>