The Desktop CPU Security Mitigation Impact On Ubuntu 20.04

[perpetually high]

the sandbox can protect it's own data from these exploits, but it can't do anything to protect the data of other software that it has no control over.

because these are vulnerabilities in hardware, many of them can't be mitigated at the sandbox level. the sandbox can protect itself, but it can't reliably prevent the sandboxed code from using these vulnerabilities to spy on software outside the sandbox, including the kernel.

Thanks for the reply, I was not aware of that. I thought that was only true for unknown vulnerabilities that had not been discovered yet (i.e. rewind back to the day Spectre/Meltdown was announced, and using one of the many that came after it to exploit).

I guess at this point it would be good to know of any real world exploits of a sandboxed instance in the wild. Once that's proven to happen and can't be mitigated in the software, I would certainly reconsider.

[skeevy420]

If Michael did that then it would not be "Ubuntu 20.04" ... it would be "Skeevy 20.04"

Nah, it'd just be Full Speed Ubuntu. Skeevy 20.04, OTOH, would come with a built-in cryptominer so I could leech off my users and maybe cover half the water bill . Unfortunately, times are tough and, unlike others we may know, I don't have a benchmarking website to implement an ad-wall as well as come up new features to entice people to buy premium to cover my bills .

Why is my 3rd core always maxed out? I run the system optimizer on the 3rd core so the first and primary core is ready when work needs to happen....figure if people are dumb enough to buy that line then they'd be too dumb to figure out my system optimizer is a cryptominer.

But on a serious note, the results being as close as they were makes me have to consider that GCC/LLVM mitigations are at play more and/or are a bigger factor now than a year ago (just seems that way to me). I suppose the only real way to test that would be with Gentoo, and, honestly, I don't that's something any of us should ask for until we have a Phoronix Bake Sale....I don't think any of us look good enough to try running a car wash.

[perpetually high]

I don't that's something any of us should ask for until we have a Phoronix Bake Sale....I don't think any of us look good enough to try running a car wash.

Hey speak for yourself, my mom thinks I'm pretty handsome.

On a slightly separate note, since the COVID-19 outbreak (second week of March or so) I stopped smoking pot entirely to make sure my lungs are strong. Been working out at home and eating real well also. So I nominate myself for a shirtless car wash for the women of Phoronix for charity. (there has to be at least ONE on here, right?)

perpetually sober, and gosh darnit it feels great. I feel like I can go months now. (I will eventually go back to smoking bud). Life is way too short not to.

[skeevy420]

Hey speak for yourself, my mom thinks I'm pretty handsome.

On a slightly separate note, since the COVID-19 outbreak (second week of March or so) I stopped smoking pot entirely to make sure my lungs are strong. Been working out at home and eating real well also. So I nominate myself for a shirtless car wash for the women of Phoronix for charity. (there has to be at least ONE on here, right?)

perpetually sober, and gosh darnit it feels great. I feel like I can go months now. (I will eventually go back to smoking bud). Life is way too short not to.

In 13 more days it'll be 4 months without a cigarette for me. Unfortunately I've replaced smoking with candy and gained weight

What kind of sucks is that I saw a thing earlier about how cigarette smokers are less likely to die from COVID if they catch it....fuck me....tried to become healthy all I did was make myself more at risk and picked up the underlying condition of fat ass

[mppix]

Thanks for the reply, I was not aware of that. I thought that was only true for unknown vulnerabilities that had not been discovered yet (i.e. rewind back to the day Spectre/Meltdown was announced, and using one of the many that came after it to exploit).

I guess at this point it would be good to know of any real world exploits of a sandboxed instance in the wild. Once that's proven to happen and can't be mitigated in the software, I would certainly reconsider.

While I sympathize with the argument "wake me up when there is a real world exploit," this is not how security is (or should be) handled. Since these are difficult but potentially lucrative exploits, you can bet that specialized groups are looking at them, think government-backed for large-scale-surveillance (US/five-eyes, Russia...). They have the means to find viable exploits, build frameworks around them, and you would not know about it until decades later.

Also, I don't see how sandboxes help here (unless the kernel has started to separate the (cores/cache) resources for sandboxes and "normal" code). This is hardware/thread execution/microcode level.

PS. For highest security, you'd even need to turn SMT off

https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html

[birdie]

Vulnerabilities impact apart, from the benchmarks it appears that my Ryzen 7 3700X, which I bought 3 weeks ago for 284€, is always performing on par or better than an i9-10980XE, which currently I could buy for... 1200+€. So yeah, call me an AMD fan.

It's amazing how you give people very sound proven known facts but since they just don't know how to twist and turn them to their favorite company advantage they start talking about everything else other than provide direct counter arguments as to why Intel is/was bad and AMD is good. I've seen bigotry but in case of AMD-fanboys/Intel-haters, it's just egregiously stupid.

How does the fact that some random Intel CPU costs more than the AMD CPU you've purchased relate to anything I've said to demonstrate that most of the flak Intel has received so far in regard to HW vulnerabilties is mostly unwarranted?

Damn, you just cannot make up excuses to show Intel in bad light. Should I remind you how fast AMD started to charge an arm and a leg for their CPUs when they got an advantage for a short while? AMD Athlon 64 FX FX-62 was released for $1031 in 2006. Adjusted for inflation that would be over $1350 today.

[perpetually high]

While I sympathize with the argument "wake me up when there is a real world exploit," this is not how security is (or should be) handled. Since these are difficult but potentially lucrative exploits, you can bet that specialized groups are looking at them, think government-backed for large-scale-surveillance (US/five-eyes, Russia...). They have the means to find viable exploits, build frameworks around them, and you would not know about it until decades later.

Also, I don't see how sandboxes help here (unless the kernel has started to separate the (cores/cache) resources for sandboxes and "normal" code). This is hardware/thread execution/microcode level.

PS. For highest security, you'd even need to turn SMT off
https://www.intel.com/content/www/us...ology/mds.html

I definitely agree, and you're not wrong. I no longer say that everyone should disable the mitigations because frankly I have no idea what people do on the web or what programs they run.

Me personally I visit maybe the same 5 websites and that's it. Let's be honest, the web is dogshit these days. I'm personally more afraid about a router exploit/vulnerability than anything else as that is my only protection from the outside world.

I've posted this phoronix benchmark before but I just performed it again-- on the same custom 5.6.4 kernel but the only difference being mitigations=off:

Without mitigations:

ctx_clock:
pts/ctx-clock-1.0.0
Test 1 of 1
Estimated Trial Run Count: 3
Estimated Time To Completion: 1 Minute [18:14 PDT]
Started Run 1 @ 18:13:44
Started Run 2 @ 18:13:48
Started Run 3 @ 18:13:53

Context Switch Time:
142
142
142

Average: 142 Clocks

With mitigations:

ctx_clock:
pts/ctx-clock-1.0.0
Test 1 of 1
Estimated Trial Run Count: 3
Estimated Time To Completion: 1 Minute [18:16 PDT]
Started Run 1 @ 18:16:03
Started Run 2 @ 18:16:10
Started Run 3 @ 18:16:17

Context Switch Time:
997
994
994

Average: 995 Clocks

That's just one benchmark but that's a performance hit on my 4c/4t Haswell that I'm unwilling to accept given how I use my desktop. But your point is completely valid.

[angrypie]

It's amazing how you give people very sound proven known facts but since they just don't know how to twist and turn them to their favorite company advantage they start talking about everything else other than provide direct counter arguments as to why Intel is/was bad and AMD is good. I've seen bigotry but in case of AMD-fanboys/Intel-haters, it's just egregiously stupid.

How does the fact that some random Intel CPU costs more than the AMD CPU you've purchased relate to anything I've said to demonstrate that most of the flak Intel has received so far in regard to HW vulnerabilties is mostly unwarranted?

Damn, you just cannot make up excuses to show Intel in bad light. Should I remind you how fast AMD started to charge an arm and a leg for their CPUs when they got an advantage for a short while? AMD Athlon 64 FX FX-62 was released for $1031 in 2006. Adjusted for inflation that would be over $1350 today.

Shintel sucks, deal with it fanboy.

[Paradigm Shifter]

Should I remind you how fast AMD started to charge an arm and a leg for their CPUs when they got an advantage for a short while? AMD Athlon 64 FX FX-62 was released for $1031 in 2006. Adjusted for inflation that would be over $1350 today.

To be fair, Intel charged an arm and a leg for their top-end consumer CPUs as well - and the Pentium-D 965 was nowhere near as fast as the FX-62. The FX-62 was $32 more expensive, and you got way more performance from the FX-62 than that 3.2% price hike would indicate.

[ktecho]

other than provide direct counter arguments as to why Intel is/was bad and AMD is good. I've seen bigotry but in case of AMD-fanboys/Intel-haters, it's just egregiously stupid.
[/B]

And they seem to forgot that with Intel you get launch day support for Linux, whereas with AMD you're going to be in the best case months until you get all in place, but it's going to probably be one or two years. Lets not forget that they got the LM_SENSORS support in place to get the temperature of latest CPUs months (years?) after launch.

So even if AMD is a lot faster than Intel, you'll need months/years of wait for it to become that faster