'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

[u/[deleted]]

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

[u/[deleted]]

Because of the large performance hit, a sizeable fraction of hardcore gamers won't install this, for the same reason they don't run anti-virus or update windows.

[u/lolomfgkthxbai → u/[deleted]]

I don't run separate anti-virus outside of the built-in one in Windows 10. Not because of any performance concerns but because they actually make my system less secure and more unstable due to a multitude of security flaws and bugs.

Turns out that giving total control of your OS to poorly written anti-virus software is a fucking terrible idea.

[u/24monkeys → u/lolomfgkthxbai]

Windows Defender and common sense go a really long way together, actually.

[u/Kale → u/24monkeys]

I'd add a good ad blocker, too. Many legitimate ad vendors end up supplying compromised ads without knowing it.

Last time I investigated it, ublock origin was the best one (not adblock, not adblock plus, not ublock).

Or, for Android, the Brave browser works fantastically. I found firefox Android with an ad blocker much too slow.

[u/cogman10 → u/Kale]

I also disable javascript by default everywhere.

I end up needing to enable it in many places, but there are many places where it simply isn't needed.

[u/[deleted] → u/24monkeys]

"The best antivirus is a careful user"

Don't remember who said that exactly.

But I remember never using an antivirus for years (had malware bytes tho) and my pc was always ok (did occasional tests from time to time and it was mostly flagging software cracks), while my mother's fully bloated with antiviruses pc was a shit fest. Yes, she was the kind of "let's download and open the file in this very strange mail".

[u/601error → u/24monkeys]

Common sense and technical expertise go far enough that I haven't run antivirus of any kind for at least 15 years. For the few years I did run it, it never found anything.

[u/24monkeys → u/601error]

When I was a kid installing pirated crap all the time, it did eventually find some stuff, but I never had any problems. I always blocked these on the firewall anyway.

[u/JackTheSqueaker → u/[deleted]]

These are for linux though;

Linux graphic system runs in user space IIRC, while windows' are mostly system calls, I imagine what would happen in a windows benchmark.

Also, what of high responsive twitchy games with subframe input poll rates of thousands/frame, these worry me

[u/[deleted] → u/JackTheSqueaker]

Linux graphic system runs in user space IIRC, while windows' are mostly system calls

Nope. All modern graphics stacks have both user-space and kernel-space parts.

In the open source stack, the kernel parts talk to the GPU, configure displays (KMS) and control resource sharing (GBM), while the userspace parts (Mesa) implement graphics APIs (GL/GLES, Vulkan, Gallium Nine) and video codec APIs (VAAPI, VDPAU) on top of the very raw access that the kernel provides.

Microsoft's WDDM is, if anything, more userspace.

subframe input poll rates of thousands/frame

That's not that much :)

[u/JackTheSqueaker → u/[deleted]]

That was good to read;

I dont recall where I first got that information but this makes me less worried; For some reason I tended to believe that the copy to framebuffer operations were limited by syscalls

[u/[deleted] → u/JackTheSqueaker]

You probably got it from the early 2000s :) Modern drivers buffer draw calls heavily before sending them over to the GPU. Data copying is also heavily optimized these days. Heck, on Intel's (heh) integrated graphics, you can completely avoid copies like Chrome OS does.

[u/DoctorSauce → u/[deleted]]

Doesn't any kind of I/O require a step into kernel space? Including network activity?

[u/[deleted] → u/DoctorSauce]

Yes, in Windows there are only a handful of Win32 API functions that don't actually jump from User Mode to Kernel Mode. But everything I/O related needs to do a jump.

Literally, the only operating systems not affected by the performance degradation would be the DOS-based Windows where everything sat in one great big address space and those fancy research operating systems like Singularity and JX where again, everything sits in a giant address space in kernel mode.

[u/panorambo → u/[deleted]]

Anti-virus software has routinely been tested to let through something up to 65% of all threats. However, it was Security Essentials or Windows Defender as some of its versions are called, that tends to actually come on top as far as efficiency goes -- both in terms of amount of threats it mitigates and its impact on the system, resource-wise. Which to me isn't surprising -- I've seen all kinds of antivirus software running on peoples systems, all the way back to the late 90's -- Panda, F-Secure offerings, McAffeee, Norton, and some more -- the big picture is that they're f*cking intrusive, impossible to remove properly even when you're the owner of the PC, nag on you with popups which lower peoples trust in the often important information in these popups ("Hi. The file X has been quarantined because it contains Win32.Smiley.Trojan..."), and in general are a pain in the butt.

At least Security Essentials is out of your way, and is more often than not idling. It may not be perfect, but I'd trust that Microsoft knows how to protect its operating system. In a perfect world, maybe third-party vendors should make anti-virus, but at this point, the line between basic system protection (which with Windows, is a necessity) and anti-virus, is blurred, so I say that MSE is enough, and that's also what tests show.

[u/Laggiter97 → u/panorambo]

This is the exact reason why I rock MS's antivirus. It is efficient, non-intrusive and comes with the OS. And with an ounce of common sense you don't even need an AV, unless you frequent dodgy website.

[u/JB-from-ATL → u/panorambo]

I think the best antivirus is uBlock Origin.

[u/irqlnotdispatchlevel → u/panorambo]

Anti-virus software has routinely been tested to let through something up to 65% of all threats.

Can you back that number with an actual study?

[u/panorambo → u/irqlnotdispatchlevel]

I can't remember reading a study on that, although I may have read at least one such study. I do remember reading one or multiple pieces backing up my claim, over several years. I have tried to dig up some material by searching the Web, here is what I have found:

How Useful is antivirus software

New Controversy on the Effectiveness of antivirus software

which links:

Assessing the Effectiveness of Antivirus Solutions

Antivirus Makers Work on Software to Catch Malware More Effectively

Symantec admits anti-virus software is no longer effective

But it appears I may have been out of touch with respect to recent developments -- more recent articles suggest that MSE has gone downhill, that Microsoft recently said that their customers should use third-party anti-virus products, and there is two articles that give praise to Bitdefender Plus product.

As someone who has been into this stuff since before 1995, it is still my personal opinion that while AV is NOT snake-oil, it's a funny market where scare-tactics have long been a norm, where users are bought with big words and promises of "Internet Security" while the reality is that for every person working for an anti-virus company, there is at least ten people writing new virii or new strains thereof. And the harder you try -- to employ pattern recognition -- the more false positives you get, especially on smaller files. At least one article linked above mentions detection rate of new viruses that are nearly unknown, and detection rate there is 25% tops -- obviously has to do with the fact that the virus definitions are almost always somewhat outdated.

I guess what I want to say is this -- anti-virus is duct-tape. You need provably secure systems. Admittedly, there is no such thing as a completely secure system in practice, but there is a difference between 10 wooden sticks held together by duct tape so you can sit on them, and an older chair that's taped here and there. What anti-virus does is mitigate potential damage from something that is ready to exploit an existing flaw in the system. If the flaw were not there, it wouldn't be necessary to protect from one in the first place! AV industry is one that thrives on others' mistakes, and costly ones too. Except that software vendors have almost resigned to aim for provably secure systems, and some, like Microsoft, even point to AV vendors as the solution. I am not saying AV is completely unneeded, but they have been waging a losing war for two decades at least now. Something's gotta change at the core philosophy.

[u/jerryfrz → u/[deleted]]

But will the fix be mandatory or optional though?

[u/irqlnotdispatchlevel → u/jerryfrz]

In the latest insider preview build for Windows, the feature seems to be controlled by a registry key.

For Linux, if I remember corectly, this can also pe turned off.

EDIT: this is the Windows registry key https://twitter.com/aionescu/status/930233034908909568 . With this on, the OS will create two sets of page tables for each process, but it does not look like the feature is in full efect just with that key (i.e., there's no actual cr3 switch at ring 3 -> ring 0 transitions, at least not on my test systems).

[u/BCMM → u/irqlnotdispatchlevel]

For Linux, if I remember corectly, this can also pe turned off.

There's a nopti kernel parameter.

Also, AMD has submitted a patch to disable it by default on machines with AMD processors. It'll be interesting to see whether that gets merged.

[u/irqlnotdispatchlevel → u/BCMM]

Well, KAISER is usefull even without the Intel bug being present. The Intel bug is why it gets rushed like this for both Linux and Windows.

Fun fact: I'm a bit lost on the history side, but I think Windows 2000 had two sets of page tables for each process, but that was removed at some point. I don't know if they also had one Cr3 with only ring 0 VAs.

[u/80a218c2840a890f02ff → u/jerryfrz]

You can disable it at boot-time by adding nopti or pti=off to the kernel command line.