If Mitigations Weren't Already Bad Enough: Slow Build Times Now Lead To An Unoptimized Intel LVI Pass

[phoronix]

Phoronix: If Mitigations Weren't Already Bad Enough: Slow Build Times Now Lead To An Unoptimized Intel LVI Pass

Disclosed back in March was the LVI attack (Load Value Injection) affecting Intel CPUs. Mitigating LVI requires compiler toolchain changes and LLVM 11 merged its LVI mitigation last month that adds a load fence after each instruction that may be vulnerable to this attack, similar to the GNU Assembler changes. Now though it's adding an unoptimized version of their LVI pass...

http://www.phoronix.com/scan.php?page=news_item&px=LLVM-LVI-Unoptimized-Pass

[eydee]

It's still required that all mitigations are removed, and instead the ones exploiting them should be punished, not the users. You don't remove knives from stores because some use them for killing. You put killers in prison. The same should apply here, put the "hackers" in jail instead of slowing down the computers of billions of innocent people.

[andyprough]

It's still required that all mitigations are removed, and instead the ones exploiting them should be punished, not the users. You don't remove knives from stores because some use them for killing. You put killers in prison. The same should apply here, put the "hackers" in jail instead of slowing down the computers of billions of innocent people.

Except in many cases the hackers are nation states who own the prisons and are looking to fill them with their hacking victims.

[Volta]

It's still required that all mitigations are removed, and instead the ones exploiting them should be punished, not the users. You don't remove knives from stores because some use them for killing. You put killers in prison. The same should apply here, put the "hackers" in jail instead of slowing down the computers of billions of innocent people.

What a naive and narrow thinking.

[LinAGKar]

It's still required that all mitigations are removed, and instead the ones exploiting them should be punished, not the users. You don't remove knives from stores because some use them for killing. You put killers in prison. The same should apply here, put the "hackers" in jail instead of slowing down the computers of billions of innocent people.

Would you mind setting all your passwords to "password"? Don't worry, we'll make sure to punish anyone who breaks into your accounts.

[gufide]

It's still required that all mitigations are removed, and instead the ones exploiting them should be punished, not the users. You don't remove knives from stores because some use them for killing. You put killers in prison. The same should apply here, put the "hackers" in jail instead of slowing down the computers of billions of innocent people.

They should make crime illegal so no crimes ever happen.

[zyxxel]

It's still required that all mitigations are removed, and instead the ones exploiting them should be punished, not the users. You don't remove knives from stores because some use them for killing. You put killers in prison. The same should apply here, put the "hackers" in jail instead of slowing down the computers of billions of innocent people.

I think you need to work a bit on the meaning of the word "required".

No, it isn't required that all mitigations are removed - who would have created these requirements?

And it isn't preferred that all mitigations are removed, because we aren't in control of the hackers. We never will be. Just as we can't leave the door open when we get to work, because we aren't in control of all people who might want to visit and steal things.

Laws that things aren't legal just aren't enough. You can still not remove all mitigations that makes it harder to commit crimes.

Do you let everyone see your PIN when you use your card? In a world where it's illegal to use someone elses card, you shouldn't need to bother if someone else knows your PIN. Well, it is illegal. But you still need to protect the PIN. Try ask your bank what they think about protecting or not protecting the PIN. Try ask your insurance company what they think about leaving the front door unlocked or leaving the keys to the car in the ignition.

[omer666]

If you leave your car open, no one's going to jail, but your car disappears.

[patstew]

Why do most of us care about these mitigations? It matters on virtual servers, but the only place that should run untrusted code on a desktop is the browser. If you're running untrusted native code you've already lost. Just denying javascript access to multiple threads and high resolution timers should be enough for most users, there's no need to totally wreck system performance.

[numacross]

Why do most of us care about these mitigations? It matters on virtual servers, but the only place that should run untrusted code on a desktop is the browser. If you're running untrusted native code you've already lost. Just denying javascript access to multiple threads and high resolution timers should be enough for most users, there's no need to totally wreck system performance.

What about the environmental impact of having to use more power to make up for all this slowdown? I'm not talking about desktop users, but servers and "clouds".

Intel is actually going to benefit from this in the short term. More demand for them...