Linux Kernel Gets Patch For New SpectreRSB Vulnerability

[azdaha]

Are there any actual examples in the wild of anyone getting compromised via any of these vulnerabilities?

Or is this simply the new performance tax we all have to pay for running a computer? Keeping in mind that performance taxes will cost you real money.

You can avoid it and risk being an example in the wild; or, since the cat's out of the bag, err on the side of caution. The performance penalty after having your sensitive data stolen might be higher than taking precautions to avoid known vulnerabilities.

[andyprough]

You can avoid it and risk being an example in the wild; or, since the cat's out of the bag, err on the side of caution. The performance penalty after having your sensitive data stolen might be higher than taking precautions to avoid known vulnerabilities.

So basically, no. No one has ever been actually successfully attacked this way in the wild. And not a single news article from anywhere in the world with an actual example.

[starshipeleven]

Are there any actual examples in the wild of anyone getting compromised via any of these vulnerabilities?

If there are, and assuming they actually noticed it, they are keeping it secret for obvious reasons. You know, the most important thing is not getting sued, not actually keeping your data safe.

If you ask if malware is actively searching for and has exploit payloads for Meltdown and Spectre, yes, like a month later. https://lifars.com/2018/02/researche...variants-wild/

It's probably too soon for SpectreRSB, but it will be added to the roster.

[starshipeleven]

So basically, no. No one has ever been actually successfully attacked this way in the wild. And not a single news article from anywhere in the world with an actual example.

FYI lack of proof means "we don't know", not "it didn't happen".
Security or even safety does not usually assume that all is fine until people die horribly, and then act only to prevent that from happening again, regardless of what the media makes it look like.

[Guest]

They have mitigations too, though..?

Yes, but they're still behind Linux in this case.

[Guest]

Depends on your use case. They all have different sets of features which yields different performance for different loads. You pick whichever performs best for you.

No, they don't. I don't buy everyone's equal bullshit.

[Djhg2000]

No, they don't. I don't buy everyone's equal bullshit.

My point was the opposite; they're not equal.

[starshipeleven]

They have mitigations too, though..?

I didn't find some authoritative source that states how and why and what I should check on Windows to confirm what is mitigated and what is not.

[Guest]

My point was the opposite; they're not equal.

I think I've got your point, but I mean they're not equal in terms of performance (and your original point was they're optimized for typical workloads which doesn't really matter in the end). There's no performance related task where Linux will fail against FreeBSD or Windows. However, there are tasks where putting Windows or FreeBSD instead of Linux will be sub-optimal. When comes to features? Stop kidding.

[Guest]

I didn't find some authoritative source that states how and why and what I should check on Windows to confirm what is mitigated and what is not.

And if there's a need for recompiling every single application.. oh God, they're doomed! Furthermore, compatibility with old applications, compatibility with old windowses etc. etc. Fix all of this mess. They weren't even able to fix a single desktop icons bug for very long time. Some windows fanboys were screaming this compatibility and stable API are features. Yes, these 'features' introduce so many vulnerabilities it's not even funny (just kidding, it's very funny)!