Be Excellent To Each Other

A problem shared is a problem halved. So were only half completely fucked, right?

I'm thinking more about playing games and stuff like that, where a 20-30% performance hit would be immediately noticeable - which from my take on this shouldn't be a result of the patches. Could be wrong though!

EDIT - And reading around elsewhere that does seem to be a standard conclusion?

One of the discovered flaws has no software fix apparently, and would necessitate complete CPU replacement.

Ouch.

Depends. The actual graphical performance of the games themselves? Probably minimal impact. Disk read-write times will likely see a hit. If you've not RAM-packed a box and there's a heavy reliance on virtual memory paging? Definitely a hit.

That's the 'Spectre' one, which is by far the harder to exploit and also, as I understand it, will not allow access across hypervisors in cloud solutions/Hyper-V hosts etc. (This affects all CPU architectures.)

The more shitty of the two is 'Meltdown', which affects Intel CPUs and is the bigger threat in cloud scenarios and suchlike. But this can be patched at a software level.

The real risk with Meltdown is that on shared web servers (AWS/Google Cloud/etc) someone could pay for a VM on a host, and then use the exploit to pinch data from other VMs running on the same host.

My current understanding of both of these exploits is that they require user input, so the old 'getting someone to click on a link' or 'run a program' and so on. (That's what makes Meltdown so bad on shared hosts, as a malicious actor could do this specifically to steal data from other VMs on the same host.)

Also that you can use Javascript running on a web page to read protected browser memory; perhaps sniffing out stored login cookies or credentials to banking websites. It might be more cost effective now to run attack JS looking for Coinbase creds than it is to run JS Bitcoin miners, for example.

You can protect against JavaScript exploiting this by making each website run in a seprate process:
Chrome: chrome://flags/#enable-site-per-process (copy and paste that into Chrome)
Firefox: https://www.ghacks.net/2017/11/22/how-t ... n-firefox/
IE / Edge / Safari: https://www.google.com/chrome/browser/d ... index.html

Note that you may see a performance hit, although I haven't noticed anything.

There's plenty of good information about what's actually happened here: https://meltdownattack.com

That is common sense..

Patched OSs are 10.13.2 of MacOs, or one of the following Windows 10 build versions:
16299.192
15063.850
14393.2007
10586.1356
10240.17738
(FFS Microsoft)

To help you decide if you need to bother:

https://twitter.com/misc0110/status/948706387491786752

Using #Meltdown to steal passwords in real time #intelbug #kaiser #kpti /cc @mlqxyz @lavados @StefanMangard @yuvalyarom https://t.co/gX4CxfL1Ax pic.twitter.com/JbEvQSQraP

— Michael Schwarz (@misc0110) January 4, 2018

As for Linux, Kernel 4.15rc6 has enabled KPTI (the patch) and it has been backported to Linux Kernel 4.14.11, 4.9.74, 4.4.109, 3.16.52, and 3.2.97.

https://cdn.kernel.org/pub/linux/kernel ... og-4.14.11

My Windows 10 is 16299.125, nothing coming from Windows update either

So I went here and got the 16299.192 update here

http://www.catalog.update.microsoft.com ... =KB4056892

-

I have the reg key they mention, maybe its just a case of waiting. I know my Dad just got Creators last week, I got it weeks ago.

I hope my Windows 10 doesn't get gimped with a blanket fix for Meltdown, as visionary forward thinkers such as myself who went for Ryzen should be unscathed.

Some early pre and post-patch benchmarks for normal PC users and PC gamers.

Games not impacted at all.

Some small impact in synthetic benchmarks, but nothing that should impact daily PC use.

It is starting to look like server workloads could suffer some serious performance impacts after the patch though. (And potentially home PCs performing 'server style' tasks, or certain productivity tasks, etc.)

AMD chips are also affected by Spectre (as are Arm chips).

Yeah but I'm not that fussed about Spectre, and the fix for it is expected to be fairly trivial anyway. (With little or no performance impact.)

I'm not even that fussed about Meltdown TBH (from a personal home user perspective), unless the baddies can make it work remotely with no user intervention required (i.e. just visiting a compromised website), and get very good at snaffling juicy information with it in the process.

Spectre is the one that can run over JavaScript and can't be patched by the OS.

I agree that the risk seems minimal at the moment, but I'm going to keep watching.

just switch off javascript!

I'm looking forward to going back to work next week just to see what kind of drama is going on from this. Also: fallout from MIFID II. Fun stuff!

AMD don't necessarily agree.

https://www.amd.com/en/corporate/speculative-execution

Their share price is rocketing, who knows if it's this or the Intel guy who has triggered sale of nearly all his shares in time for a significant release, or both.

So this, or something like it, may be in my near future: https://uk.pcpartpicker.com/list/rvswM8

(From my existing PC, I'd be recycling: GeForce 970, 2.5" SSD, 1x HDD, keyboard/mouse, current monitor (Samsung 26" 1600x1200, would be upgraded later))

Nice spec, boo for Intel, but they are pricing the 8600K aggressively.

Will make for a very capable small gaming PC.

I won't consider AMD, mostly because of shocking Linux support. I don't think this PC would spend much time booted into Linux but I still don't want to shut that door. Also I want to recycle my nVidia and it'd be just my shitty luck to run into AMD chipset <-> nVidia GPU issues of some obscure kind. I'm the guy who put a Riva TNT into an Ali V chipset motherboard then had to play the entirety of Half-Life in software rendering.

Shady stuff like this annoys me about Intel:



And the guy called exactly this in a previous video:

In terms of convincing me of stuff, 55 minutes of YouTube is only slightly more likely to work than a massive corkboard covered in newspaper clippings linked up with red string plus John Doe's diary from Se7en.

At risk of being an old man, I really don't get the popularity of YouTube videos for conveying information that has no need to be visual. Write it the fuck down, then I can read it at my leisure and avoid people's horrible voices.

x 52

Whilst your turn of phrase is amusing, it doesn't give the guy any due respect for doing a very good job of researching consistently informative and insightful tech commentary.

And of course, more mainstream media outlets or tech reviewers are unimpeachably conscientious when it comes to their coverage....

Indeed, what this chap predicted (as it turned out, entirely correctly), was that many initial Coffee Lake reviews were based on hand-picked silicon in top-end motherboards with premium cooling solutions and the motherboards' 'auto-tweak' functionality enabled, and that once the chips started getting out into mainstream builds we'd start to see very different performance numbers.

And that has proven to be the case, with what are supposed to be the 'same' chips in more mainstream OEM PCs, the performance deficit can be as high as 20%.

It also highlights the shadiness and deliberate change in how Intel convey their chips' base clocks versus turbo clocks, across how many cores, and for how long.

In simple terms, in the initial reviewed systems the chips were basically able to turbo their nuts off 100% of the time and irrespective of load pattern, plus the motherboards were using a setting that tweaked things further.

Put exactly the same CPU in a mainstream motherboard, with mainstream cooling, and use chips that haven't been hand-picked by Intel, and lo and behold they can turbo for about 8 seconds before starting to throttle.

This can end up with an expensive Intel CPU being outperformed by a far cheaper Ryzen CPU (which can also be on a cheaper motherboard), and makes of a mockery of many of the original reviews of the Intel Coffee Lake CPUs and what their expected performance is.

I don't get it, is there some sort of snobbery involved, or some other prejudice, that means if it's on YouTube it must be wrong and/or unbelievable and/or not worth watching and/or capable of conveying any useful information?

It's a bad medium. Write it the fuck down.

Although Gaywood merrily shares 80,000 word essays spread over countless Twitter posts, so he can STFU and SMB KEK

The kids watch more videos than read stuff anyway. It’s on trend.

Sat is right. I attended a marketing course about a year ago and they said that YouTube is basically huge and the kids love it more than Twitter and Facebook.

I do agree though, I'm more likely to read an article than watch a video.

No, it's more that when you're watching a video you are being forced to go at the pace of the person that has produced that video.

Programming tutorials (especially game programming, like Unity) are particularly annoying as of late, because instead of having everything nicely written down with code that I can copy and paste if I want, and that I can read at my own pace and even skip bits that I already know, I instead have to listen to some guy (who undoubtedly knows his onions, so it's not a reflection on their skills) drawl on about "prefabs" for 5 minutes before he actually gets to the bit that matters, and then it turns out he's typing at five words per minute so that the viewers aren't overwhelmed, so I end up having to wait 5 minutes for something I could read and digest in a matter of seconds if it was just all readable from the start.

Boils my fucking piss.

Each to their own, I much prefer YouTube videos as I can listen to them and (semi)-watch them whilst doing something else. Like, I'm down in the kitchen now, and whilst I'm making tea for Mrs Hearthly and getting mine ready for later on (and drinking nice wine because FRIDAY), I'll catch up on a couple of Hearthstone and tech videos.

I'm subscribed to Custom PC, PC Pro and Private Eye, and it's a challenge to have each of those read before the next one drops through the letterbox.

Also I think video adds to the experience, I'm very keen on a guy who produces 'video essays' on YouTube, could he write them down? I guess so but he'd lose the visual aspect of what he does with footage of games as reference points and suchlike.

Don't get me wrong, I like a good read as much as the next person, but this rather sniffy dismissal of YouTube as essentially worthless by a couple of folks strikes me as rather off TBH.

I basically hate anything I have to give my undivided attention to, because I'm busy doing 18 other things. An article I can read at my leisure, I can read while I'm on the phone, I can easily refer back to cross-reference earlier comments, it can have links in it to other related media. Video is just a terrible medium for that sort of content, in my view.

I appreciate, of course, that that's entirely based on how I consume information. I also place no judgement on the content whatsoever - I'll just never view it.

Nobody's said that. There's tons of stuff for which video is a great medium.

I can easily watch 30-60 minutes of YouTube some days, so it's not like I'm a stranger to it. I'm just not going there for breathless conspiracy theories.

No not snobbery at all (at least I don't think it is). If what I'm being offered is essentially a tract of text, I'd rather read it myself rather than have it read to me. That way I can move at my own pace and don't have to put up with the mumbles and voice of someone else. If I'm playing an adventure game, I'll often skip the voice dialogue part-way through its delivery, because I've already read what's on-screen. YES, I AM THAT MADCAP.

There is some amazing stuff on YouTube! However the bar is set very low for entry and that's where the reputation comes from.

Also all the shouty men.

Again, not having a go at the content, just saying that video as a medium is pointless if your content isn't visual.

You mean the well researched piece that cites all its sources and evidence to support the case being made?

EDIT - Typos, don't chop chillies and type at the same time. And definitely don't rub your eyes.

Or go for a pee...

No, if you're rubbing your eyes while you pee you might piss all over the floor.

Even if it is visual the amount of faffing around before someone gets to the crux of what the video is about can be infuriating. I do a lot of things with what are primarily visually learned mediums for a lot of people (knitting, art and creative things...) and though I simply don’t learn that way myself I do understand that I seem to be in the minority. I prefer written instructions I can scan, and diagrams if necessary.

When I have been forced to use a video there is invariably about seven minutes of someone drawling slowly on about how they are holding the needles, why they knit continental, if they’re using a pirtuguese knitting pin, where their yarn is from... all the while fiddling with the yarn or the fabric. The actual point of the video, maybe the demonstration of a stitch or technique is about six seconds long somewhere in the middle before they then start back to talking about something else. And to make it as clear as possible it does seem to mean that people want to fo at a crawling snail’s pace to get to the information. I am not anti YouTube, but now so many people use it as a source of instruction it means that there are fewer written alternatives, and everything is painful.

We once had a new bit of software being bought into the business and for some ridiculous reason they decided that rather than write a user guide they wanted to make individual videos for each of the hundreds of functions.

Luckily I left at that point, and I don’t *think* they ever did, but if they had gone ahead whilst I was still there I’d probably have lost mind.

Instructions unclear; just rubbed piss in my eyes.

Wadsworth constant

So there are two strands of objections here, and they're very different.

DocG in particular is simply being dismissive of the content I linked to, choosing to denigrate it with language such as 'breathless conspiracy theories' and of course the original glorious witticism:



Whereas Mimi and GazChapfor example, have a far more practical objection in that it's a bad medium to convey instructions for a particular task or process, that would be much better written down - and that's a perfectly understandable objection.

It's the former that I have a problem with, the implication being that because it's just 'a bloke on YouTube' the material almost by definition is incapable of being worthwhile, well-researched, interesting, informative or anything else. That chap in particular goes to great lengths to cite all his sources and reasoning, backing up his cases with evidence and being quite clear when he's expressing an opinion about something.

The truth is that he called it early and he called it right with Coffee Lake, at a time when the 'mainstream and respectable' sites were creaming themselves over Coffee Lake's incredible performance and not even realising that the chips they were benching were being 'auto-tweaked' by the high end motherboards they were testing in, and some of them have got very arsey about being called out on their shoddy journalism.

I thought it was an excellent video and the guy has a brilliant rich Scottish accent.