Spectre/Meltdown/L1TF/MDS Mitigation Costs On An Intel Dual Core + HT Laptop

[coder]

I don't understand why they keep patching holes on Intel CPUs. As long as you don't kill Intel Management Engine IME, you are actually exposed as a naked fly.

Don't be silly - they have different exposure profiles.

You can be exposed to Spectre/Meltdown vulnerabilities even from Javascript code running in a web browser, whereas IME would not. AFAIK, IME vulnerabilities require local code execution, or at least being on an unsecured network.

[ArchLinux]

Once again great stuff by Michael

Really weirdo stuff by the commenters:

Intel is a mess. I hope in a class action against this scammer!

This is one of the few situations where I've actually been able to notice the performance losses without needing benchmarks to confirm my observations. I've noticed my i3 Haswell laptop getting slower and my overall CPU usage going up the past few months.

I'm actually a little surprised Intel hasn't been more heavily hit yet. I don't think anyone could sue them for the slew of security risks they put so many millions of people into, but, they could be sued for selling products that don't perform to the specs they expected. Not only has Intel not lowered their prices, they actually brought them up, due to the shortage

Intel isn't under obligation to have vulnerability-free products, geniuses.

[schmidtbag]

Intel isn't under obligation to have vulnerability-free products, geniuses.

Um... yeah, they kinda are... By your logic, are you suggesting cities aren't obligated to have police? Or that banks shouldn't have hefty vault doors?
Nobody in their right mind would ever willingly buy a less secure product, especially if it meant securing it meant losing the performance you were advertised. Considering the vulnerabilities are at the hardware level, that means it is a design fault on their end. There's no argument here; Intel is obligated to sell a non-faulty product. So whether you care about the vulnerabilities or not, Intel is still obligated to be vulnerability-free.

[ArchLinux]

Um... yeah, they kinda are... By your logic, are you suggesting cities aren't obligated to have police? Or that banks shouldn't have hefty vault doors?
Nobody in their right mind would ever willingly buy a less secure product, especially if it meant securing it meant losing the performance you were advertised. Considering the vulnerabilities are at the hardware level, that means it is a design fault on their end. There's no argument here; Intel is obligated to sell a non-faulty product. So whether you care about the vulnerabilities or not, Intel is still obligated to be vulnerability-free.

Neither of those examples have anything to do with the product you purchase. Are actual security companies (AV/FW) obligated to reimburse you for damages caused by malware? If Intel loudly claimed to fix all security faults ASAP yet actually wouldn't at _all_, yeah, you could sue and have a point.

Their non-invulnerable solutions aren't up to your standards, buy something different.

[Azrael5]

Once again great stuff by Michael

Really weirdo stuff by the commenters:
Intel isn't under obligation to have vulnerability-free products, geniuses.

So you are an idiot. If an item is affected by vulnerabilities which can damage the user, the enterprise must notify the vulnerabilities to the user, idiot.

[schmidtbag]

Neither of those examples have anything to do with the product you purchase.

Yes actually, they do. A lot of people move to a city because of its public safety. People use banks for the sake of keeping it protected, either from hazards or from other people (at least in principle). You don't move to a city solely because of the police, and you don't use a bank solely because of their vault door.

Are actual security companies (AV/FW) obligated to reimburse you for damages caused by malware? If Intel loudly claimed to fix all security faults ASAP yet actually wouldn't at _all_, yeah, you could sue and have a point.

If antimalware companies claim they're supposed to protect your PC and fail to do so, as far as I'm concerned, yes, you should be reimbursed for damages, because the product failed to do its job.
You're missing the point though: it doesn't matter if Intel fixes the problems quickly. You bought a product expecting a certain level of performance and with the mitigations, you aren't getting what you paid for. THAT'S the problem here.
So, if you want to argue "then leave the CPU unsecured" well, that's still misleading, because nobody in their right mind would deliberately buy something known to be unsafe when pretty much all competing products from every other brand can accomplish the same thing without being unsafe.

Their non-invulnerable solutions aren't up to your standards, buy something different.

I do and will.

[angrypie]

If only enthusiasts boycott Intel it won't make a dent in their brand and sales. Laypeople/know-it-all dumbfucks will still look for and buy Intel products. Most don't even know AMD exists, and those who do still think they're an off-brand that copies Intel's designs like it's 1990.

[ArchLinux]

So you are an idiot. If an item is affected by vulnerabilities which can damage the user, the enterprise must notify the vulnerabilities to the user, idiot.

Or what?

[ArchLinux]

Yes actually, they do. A lot of people move to a city because of its public safety. People use banks for the sake of keeping it protected, either from hazards or from other people (at least in principle). You don't move to a city solely because of the police, and you don't use a bank solely because of their vault door.

If antimalware companies claim they're supposed to protect your PC and fail to do so, as far as I'm concerned, yes, you should be reimbursed for damages, because the product failed to do its job.
You're missing the point though: it doesn't matter if Intel fixes the problems quickly. You bought a product expecting a certain level of performance and with the mitigations, you aren't getting what you paid for. THAT'S the problem here.
So, if you want to argue "then leave the CPU unsecured" well, that's still misleading, because nobody in their right mind would deliberately buy something known to be unsafe when pretty much all competing products from every other brand can accomplish the same thing without being unsafe.

I do and will.

So you want it to be secure or you want it to be fast? Because they had a fault that prevent both (mostly in servers) at the same time, so they provided a fix for you.

You're free to try and sue of course if your expectations were not met.

[schmidtbag]

So you want it to be secure or you want it to be fast? Because they had a fault that prevent both (mostly in servers) at the same time, so they provided a fix for you.

You're free to try and sue of course if your expectations were not met.

First of all, don't necropost. You're over a year late to respond.
Second, no: I want it to be secure and as fast as it was advertised to be. It's not a difficult concept to grasp. You deserve to get what you paid for, and what you pay for should be able to hold up to the claims or level of performance that is advertised. Benchmarks are effectively part of the marketing, even 3rd party benchmarks. Many people buy a product because of benchmark results. So when the product is littered with vulnerabilities and must be downgraded in order to remain secure, that's misleading.

As for suing them, there's already been lawsuits over that. I'm not sure how they turned out.