Conversation

Notices

1. Christopher Lemmer Webber (cwebber)'s status on Saturday, 11-May-2019 14:41:07 UTC Christopher Lemmer Webber

   Would you buy/use a computer that ran 3x slower than modern machines if it were more secure (less vulnerable to side-channel attacks)?

   [ ] yes, absolutely
   [ ] yes, but not for games
   [ ] no, I need all the speed

   • Christopher Lemmer Webber (cwebber)'s status on Saturday, 11-May-2019 14:41:30 UTC Christopher Lemmer Webber

     in reply to

     crossposted to https://twitter.com/dustyweb/status/1127222086144020480

   • Christopher Lemmer Webber (cwebber)'s status on Saturday, 11-May-2019 15:15:07 UTC Christopher Lemmer Webber

     in reply to

     Interestingly, the numbers are very different on here than they are on birdsite. Many more people here seem to be willing to take a speed hit for security here than there. Not surprising, I suppose: selection bias.

   • Bob Mottram 🔧 ☕ ✅ (bob)'s status on Saturday, 11-May-2019 15:20:05 UTC Bob Mottram 🔧 ☕ ✅

     in reply to

     • Bob Mottram 🔧 ☕ ✅
     @cwebber It depends how you measure speed, but in general yes.
     
     My requirements for development are not very significant. I can work easily on a 4 core A53. I don't care about games or 3D graphics, other than that browsers often make use of it.
   • Mike Gerwitz (mikegerwitz)'s status on Monday, 13-May-2019 02:51:25 UTC Mike Gerwitz

     in reply to

     • Alexandre Oliva
     @lxoliva had some compelling words about this at LP2019:
     
     https://media.libreplanet.org/u/libreplanet/m/who-s-afraid-of-spectre-and-meltdown/
     
     I don't know if your comment related at all to Spectre, but---if all the software running on your system is free software, what is there to fear? And I agree.
     
     The biggest trouble is that people often run non-free and untrusted code all of the time in their web browsers, and don't see it as a software freedom or security issue. It's important to recognize it for what it is---untrusted, unsigned, ephemeral software---if you're going to consider security tradeoffs when it comes to certain mitigations. I personally don't run JS at all, even if it's free, with very few exceptions, because it's unsigned.
   • Christopher Lemmer Webber (cwebber)'s status on Monday, 13-May-2019 11:28:55 UTC Christopher Lemmer Webber

     in reply to

     • Mike Gerwitz
     • Alexandre Oliva

     @mikegerwitz @lxoliva I'm glad you ack'ed the "not signed" aspect; regarding the nonfree vs free software: mark the metadata of javascript as librejs compatible, then perform a read or write attack against the system. (Heck, it even *could* be free software compliant; most likely the target isn't checking the licensing situation when they're under such attack, but it's also trivial to lie about it.)

   • Christopher Lemmer Webber (cwebber)'s status on Monday, 13-May-2019 11:31:21 UTC Christopher Lemmer Webber

     in reply to

     • Mike Gerwitz
     • Alexandre Oliva

     @mikegerwitz @lxoliva However, we shouldn't believe that just because something is free software that it is trustworthy, or that we have the capacity to fully audit our software systems for security. The sad reality is that people run way too much code to be able to trust or audit systems, and Ka-Ping Yee's thesis showed that if an attacker wants to add vulnerabilities to (even free) software, even the best programmers won't detect it http://zesty.ca/pubs/yee-phd.pdf

   • Christopher Lemmer Webber (cwebber)'s status on Monday, 13-May-2019 11:34:30 UTC Christopher Lemmer Webber

     in reply to

     • Mike Gerwitz
     • Alexandre Oliva

     @mikegerwitz @lxoliva At any rate, defense in depth. Free software helps, but we shouldn't be saying "well, we're not going to be bother with these other (critical) layers because we're just focusing on this one layer."

     Also as someone who wants to build a decentralized, free software powered distributed game where you can safely run other peoples' game code, heck yeah I want to be sure that it doesn't open my system to attacks.

   • Alexandre Oliva (lxoliva)'s status on Monday, 13-May-2019 13:04:52 UTC Alexandre Oliva

     in reply to

     • Mike Gerwitz
     @mikegerwitz @cwebber it's not just about being free software, you have to actually know that it does what you wish, which requires auditing by a trusted party. truth is we've long known about side-channel attacks that allow information leaks. s&m aren't the first nor the last of these, and some are deemed unfixable, so if you wish to run untrusted code on your system, you'd better not have information you wish to keep private on it
   • Mike Gerwitz (mikegerwitz)'s status on Tuesday, 14-May-2019 09:01:28 UTC Mike Gerwitz

     in reply to

     • Alexandre Oliva
     @cwebber @lxoliva Certainly we need to trust it as well. But if you're installing software on your system, there are generally other, more effective ways to compromise the user than resorting to side-channels.
     
     But ensuring your software is signed and reproducible also helps to mitigate targeted attacks---if you're running the same software that everyone else is running, then the risk is very high for someone to do something malicious and tarnish their reputation.
     
     Many users just `curl foo | sudo sh` the latest hot thing as they're instructed.
   • Christopher Lemmer Webber (cwebber)'s status on Tuesday, 14-May-2019 13:18:03 UTC Christopher Lemmer Webber

     in reply to

     • Mike Gerwitz
     • Alexandre Oliva

     @mikegerwitz @lxoliva I don't think we're disagreeing there. I'm just arguing for a *multi-pronged approach*, and from there I don't understand where the objections are coming from. I have a hard time believing that if we had a community-oriented libre-hardware-design RISC-V machine that was less vulnerable than these side channel attacks that the bunch of us wouldn't advocate that people should use that *and* free software.

   • Mike Gerwitz (mikegerwitz)'s status on Wednesday, 15-May-2019 00:45:08 UTC Mike Gerwitz

     in reply to
     @cwebber Oh, I would certainly advocate for libre hardware. What I was replying to was your original message:
     
     > Would you buy/use a computer that ran 3x slower than modern machines if it were more secure (less vulnerable to side-channel attacks)?
     
     I interpreted this as buying a modern e.g. Intel processor that has Meltdown/Spectre microcode mitigations, which can cut performance of certain processes by half (which we have to deal with at work).
     
     But RISC-V is another story. We actually gain something substantial there.
   • Christopher Lemmer Webber (cwebber)'s status on Wednesday, 15-May-2019 13:53:04 UTC Christopher Lemmer Webber

     in reply to

     • Mike Gerwitz

     @mikegerwitz I wasn't talking about the microcode updates specifically, but I think they're also a good example if you put the non-freeneess aside of the question as I posed it. But for context, what prompted this conversation was a chat on Friam (meeting of some programming language nerds that happens once a week) where Meltdown/Spectre were discussed, and more fundamental cpu architectural changes were proposed (as well as changing some ways we program, because it's Friam)

   • Mike Gerwitz (mikegerwitz)'s status on Thursday, 16-May-2019 02:06:01 UTC Mike Gerwitz

     in reply to
     @cwebber Ah, well, to actually answer your question:
     
     - I generally prefer to mitigate issues, even if that means inconvenience or lack of performance. I put a great deal of time into making life intentionally difficult for myself, for many different things, in the name of security.
     
     - In certain circumstances, I may choose not to adopt that practice depending on my threat model and the tradeoffs.
     
     - For people who aren't able to understand the risks and tradeoffs thoroughly, I'd recommend that they go with less performant systems in favor of mitigations.
     
     - BUT, in the context of Intel, their microcode updates are non-free, and so I won't install them, and I won't recommend that people install them. But I will warn them of the risks.
     
     TBH this is the main thing making me wary of purchasing a Purism laptop---I really would like to eventually, but I'm having a lot of trouble justifying using an Intel processor (or most modern hardware, for that matter, that isn't libre) for any computing that I may consider sensitive. And a personal laptop inevitably falls under that category.
     
     It's a shitty situation. But yes, I would consider purchasing a computer that's 3x slower for personal computing. If I'm doing something CPU or memory intensive like compilation, I usually offload to a separate box anyway, since that isn't usually sensitive.
     Christopher Lemmer Webber likes this.