Intel Developer's Patch To Let SECCOMP Processes Like Web Browsers Opt Out Of Spectre V4

[phoronix]

Phoronix: Intel Developer's Patch To Let SECCOMP Processes Like Web Browsers Opt Out Of Spectre V4

Currently the Linux kernel SECCOMP secure computing mode force-enables Spectre protections, which comes with obvious performance implications. When force-enabled, however, processes can't opt-out of the protection if they are not at risk to the likes of Spectre V4 "Speculative Store Bypass" issues. But a simple change being proposed would let such processes opt out if desired...

http://www.phoronix.com/scan.php?page=news_item&px=SECCOMP-Opt-Out-SSBD

[Charlie68]

Seen the home use of my notebook, I chose this solution.

[Volta]

Patching Titanic? What a delusional company.

[mhartzel]

Great idea, let processes opt out of mds mitigations. What could possibly go wrong......

[ktecho]

Great idea, let processes opt out of mds mitigations. What could possibly go wrong......

Please, read the article. Or read it again if you already did.

[k1e0x]

Please, read the article. Or read it again if you already did.

The article says they intend to do this because those processes run in a sandbox. My understanding of MDS is that doesn't matter. I'm with mhartzel.. Leave these on permanently.

[mlau]

the first users are going to be malware and benchmarks

[blackshard]

That's rather funny, now processes may decide to what cpu bug they want to be vulnerable to. Great deal

[starshipeleven]

Seen the home use of my notebook, I chose this solution.

Hackers want to know your location.

[Charlie68]

Hackers want to know your location.

Hi, on this notebook I don't have sensitive data, so I'm quite calm. I know very well that it's not a great idea and I don't do it on my main pc, but this notebook was born with a poor cpu, with all the security patches it's becoming embarrassing . 🙄