0

I was guessing which could be the practical downsides of the patches for these risks and also if a user decides to not apply these patches.

Preamble:

In the middle of January I bought a refurbished HP laptop, provided with an Intel i5-3320M (Ivy Bridge), which I upgraded with 8 GB of DDR3 RAM and a Samsung SSD 850 EVO; the OS is Windows 7 Ultimate 64 BIT; since the first day I obviously installed all the recommended patches from Microsoft, and I think that there was also already available the patch against Meltdown, which is activate by a pair of registry keys: FeatureSettingsOverrideMask and FeatureSettingsOverride as reported here https://social.technet.microsoft.com/Forums/en-US/fd9f2f4f-2534-4d61-86cd-fa5f38ac1557/meltdown-and-spectre-must-registry-value-featuresettingsoverride-manually-set-after-patch?forum=winserver8gen

Furthermore also HP released a patch, against Spectre, which consists in a BIOS update for the microcode of the processor. For now I had only enabled the patch against Meltdown. I tried to disable the Meltdown patch, and I clearly see an improvement in the general responsiveness of the laptop, is not an exaggerated improvement, but is evidently noticeable: I could say that I could live with this patch enabled, but i fear that if I will also install the BIOS patch, I would see a more evident decay of the general performance of my laptop, also in terms of battery life. Furthermore the patch from Microsoft is easy to disable, but if I update the BIOS, HP seems to state that is not possible to revert to an old BIOS revision.

The questions:

I read that both Spectre and Meltdown must be transmitted with malware software, also through a webpage’s javascript, so: Is not an updated and good antivirus/antimalware enough against these risks? And what about a browser addons like ublock origin and noscript? I think that the usual rules apply: "stay away from malicious websites and software", or is not enough?

By installing/enabling both patches, in which exactly terms these will impact the performances? I heard something about general troubles here: https://newsroom.intel.com/news/root-cause-of-reboot-issue-identified-updated-guidance-for-customers-and-partners/ I mean: the slowness, which part of the hardware/software will bite? The speed of ram? Will make heavy the load on the processor? Is kernel related? Could impact the battery life?

And the last important question: what we could expect for the future? There are, still, a lots of old operating systems and no longer upgradable firmwares; will come a day where/when engineers will be able to quash these vulnerabilities?

closed as too broad by EBGreen, music2myear, DavidPostill Mar 28 '18 at 11:49

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • These are questions that have a) been answered with more authority elsewhere, b) are much too broad to answer here, c) require information we do not have access to. They are good questions, but they are not the sorts of questions SuperUser is really capable of answering. – music2myear Mar 27 '18 at 17:20
  • Performance impacts are entirely based on the hardware. There was virtually no impact on newer hardware only legacy end of life products experienced any measurable impact on performance. Your other two questions cannot be answered, We cannot predict the future, there are currently two additional branch prediction vulnerabilities. One should be clear, Meltdown, does not come with a performance hit.. – Ramhound Mar 27 '18 at 17:32
  • At this time Intel has not released any updated to the firmware for your CPU. So it is impossible for you to patch against the second variation of Spectre. Microsoft has also not release the firmware patch, which is applied every time the machine boot, for your CPU at this time. – Ramhound Mar 27 '18 at 17:36
1

Meltdown and Spectre are greatly overrated, and at the risk of being shouted down I would say that they are not worth protecting yourself against. Certainly not when it means losing performance. They cannot be used as attack vectors in order to infect an as yet uninfected computer.

The protection is currently achieved by turning off useful optimizations in the CPU that allow some unauthorized access to system and user memory. Future CPUs will have in-built protections that will still allow the CPU to work at full speed.

Meltdown and Spectre weaknesses can only be exploited by software running on the computer. That means that the computer is already badly infected and the hacker is already running his programs on your computer.

At this point of infection, Meltdown and Spectre are really your last worry.

You should in my opinion concentrate on general protections : Not to execute programs you find on the Internet or open documents or video originating from doubtful sources, install browser protections such as NoScript against the unsupervised execution of JavaScript, etc. according to the well-known guidelines.

As long as your computer is not infected, Meltdown and Spectre are not a problem.

For more information, see the Meltdown and Spectre site.

Not the answer you're looking for? Browse other questions tagged or ask your own question.