Your Intel powered PC may soon be 30% slower

[Biggsy]

(Well, slowed by 5 to 30%, depending on the task and CPU model).

Shit news:
www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

Glad I've been procrastinating so long with my PC upgrade.  Would have been gutted if I had recently bought an affected CPU.

[spesh]

https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html

[Greenbank]

"Meltdown" affects Intel chips.

"Spectre" affects most chip manufacturers (Intel, AMD, ARM, etc).

But "Meltdown" is several orders of magnitude worse than Spectre in terms of a security vulnerability.

[Afasoas]

I'm lead to believe enabling first party isolation in the browser may help prevent exploits via the browser:

Chrome:
https://support.google.com/chrome/answer/7623121?hl=en

Firefox:
https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox/

This is quite a rancid turd burger of a problem. We've a lot of patching to do over the next few days.

[SoreTween]

Glad I've been procrastinating so long with my PC upgrade.  Would have been gutted if I had recently bought an affected CPU.

I thought exactly the same.  It will be interesting to see the revised Intel vs AMD real world workload benchmarks in a few weeks.

[simonp]

My Macs have been patched for some time, and I'd not noticed any performance issue.

It seems that only heavily I/O bound processes are significantly affected. So it would be a different story for a cloud server than for a desktop PC.

[pcolbeck]

Glad I've been procrastinating so long with my PC upgrade.  Would have been gutted if I had recently bought an affected CPU.

I thought exactly the same.  It will be interesting to see the revised Intel vs AMD real world workload benchmarks in a few weeks.

You probably have an affected CPU as this goes back years and years not months.

[Biggsy]

The point is that we're glad we haven't recently spent money on replacing an affected CPU with another affected CPU.   I'll wait a bit longer before upgrading until I'm clearer on what models won't be slowed down too much by OS patches.

[mrcharly-YHT]

"Meltdown" affects Intel chips.

"Spectre" affects most chip manufacturers (Intel, AMD, ARM, etc).

But "Meltdown" is several orders of magnitude worse than Spectre in terms of a security vulnerability.

AMD claim that neither affect them.

[hubner]

Has anyone seen a list of the affected CPUs?

It seems chips without out-of-order execution and speculation execution are not affected.

Intel doesn't want you to know that every Intel processor since 1995 that implements out-of-order execution is potentially affected by Meltdown – except Itanium, and the Atom before 2013.

Lucky all you Atom netbook users out there!

[Greenbank]

"Meltdown" affects Intel chips.

"Spectre" affects most chip manufacturers (Intel, AMD, ARM, etc).

But "Meltdown" is several orders of magnitude worse than Spectre in terms of a security vulnerability.

AMD claim that neither affect them.

https://www.amd.com/en/corporate/speculative-execution

They also claim that no-one has yet demonstrated the second variant on an AMD chip and that there is "near zero risk". This is different from their statement against the severe one (Meltdown - Variant 3) where they say they aren't vulnerable at all.

[SoreTween]

More good info here:
https://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

[frankly frankie]

"Meltdown" affects Intel chips.

"Spectre" affects most chip manufacturers (Intel, AMD, ARM, etc).

But "Meltdown" is several orders of magnitude worse than Spectre in terms of a security vulnerability.

AMD claim that neither affect them.

Yes but it's not the problems that are the problem, it's the solution.

[Biggsy]

I'm hoping that operating systems will eventually apply the workaround only to vulnerable CPUs.  Maybe that's hoping too much.  Meanwhile, a forthcoming Linux patch, for example, won't descriminate.  AMD are advising against installing it.  Don't know what's happening with Windows yet.

[andyoxon]

Slower by 5% will make no difference.  30% may be a problem.   My guess is that the average home user won't notice unless it effects HD streaming.

[SoreTween]

Eben Upton has written an excellent explanation of how Meltdown works and why Raspberry Pi are not vulnerable.

[vorsprung]

I get up every morning knowing that stuff like this is out there just waiting to happen

The difference last week was that it was on the BBC

All the stuff at work is in the cloud, AWS

Cloud providers are claiming that they have already factored in a lot of protection

[Afasoas]

I've patched most my home stuff (Debian) for meltdown.

Definitely had an effect. Spot when I rebooted after the kernel upgrade?


https://imgur.com/a/Bs8Ao

Bear in mind that this server has a very light workload.

[Morat]

"Meltdown" affects Intel chips.

"Spectre" affects most chip manufacturers (Intel, AMD, ARM, etc).

But "Meltdown" is several orders of magnitude worse than Spectre in terms of a security vulnerability.

True. AIUI Meltdown is the easier one to patch and is the one that we've received patches for, but Spectre is going to be affecting us for a while.