OpenSUSE Adds Option To Installer For Toggling Performance-Hitting CPU Mitigations

[Shiba]

before ubuntu even existed, suse was ubuntu.

I still have my boxed SuSE professional 9.0, it featured automount of usb devices! >

[R41N3R]

Adding more options to an installer doesn't sound right to me, especially when it is already quite complicated like in the case of opensuse. This sounds more like a tuning option after install!

[karolherbst]

This is a very welcome change! Those mitigations make little sense if only trusted code will be executed.

and how to you guarantee that? With a multithreaded web browser it can always possible to make use of hardware defects where threads aren't isolated correctly. And in doubt all Javascript code is untrusted.

For a desktop you never want to disable the mitigations. For some servers it might make sense to do so though.

[yurikoles]

This is good to see, and I'll bet they've built a YaST module too then, so you can make the same changes after installation.

The installer is YaST itself, so there is definitely a module for that.

[starshipeleven]

For a desktop you never want to disable the mitigations. For some servers it might make sense to do so though.

Also for many embedded devices. Not that SUSE runs any significant amount.

[zxy_thf]

and how to you guarantee that? With a multithreaded web browser it can always possible to make use of hardware defects where threads aren't isolated correctly. And in doubt all Javascript code is untrusted.

For a desktop you never want to disable the mitigations. For some servers it might make sense to do so though.

I'm talking about servers, not desktops.

[zxy_thf]

That's not the case. "Trusted" code can have security vulnerabilities.

In order to exploit those hardware bugs, the attacker must be run able to run custom code that does crazy things.
If the attacker could run arbitrary code on the server, the sys admin certainly would have more important things to worry about.

[yurikoles]

Also for many embedded devices. Not that SUSE runs any significant amount.

On Linux.org.ru there is a mem: SUSE-Router

[brad0]

Also for many embedded devices. Not that SUSE runs any significant amount.

That's the worst possible place to disable it. But if you want to make a dumpster fire of shitshow even more shitshow go ahead.

[starshipeleven]

On Linux.org.ru there is a mem: SUSE-Router

I don't know what you mean.

But "router" is a networking job. Smaller routers are embedded devices, bigger ones are true server hardware. Server-grade distros are also used to make a high-end router. Not everyone is running Cisco.