https://git.kernel.org/…/ke…/... sure some of you are working on the patches already, if you are then lets connect cause, I am an ardent researcher for the same as of now.

So here it goes:

As soon as kernel page table isolation(KPTI) bug will be out of embargo, Whatsapp and FB will be flooded with over-night kernel "shikhuritee" experts who will share shitty advices non-stop.

1. The bug under embargo is a side channel attack, which exploits the fact that Intel chips come with speculative execution without proper isolation between user pages and kernel pages. Therefore, with careful scheduling and timing attack will reveal some information from kernel pages, while the code is running in user mode.

In easy terms, if you have a VPS, another person with VPS on same physical server may read memory being used by your VPS, which will result in unwanted data leakage. To make the matter worse, a malicious JS from innocent looking webpage might be (might be, because JS does not provide language constructs for such fine grained control; atleast none that I know as of now) able to read kernel pages, and pawn you real hard, real bad.

2. The bug comes from too much reliance on Tomasulo's algorithm for out-of-order instruction scheduling. It is not yet clear whether the bug can be fixed with a microcode update (and if not, Intel has to fix this in silicon itself). As far as I can dig, there is nothing that hints that this bug is fixable in microcode, which makes the matter much worse. Also according to my understanding a microcode update will be too trivial to fix this kind of a hardware bug.

3. A software-only remedy is possible, and that is being implemented by all major OSs (including our lovely Linux) in kernel space. The patch forces Translation Lookaside Buffer to flush if a context switch happens during a syscall (this is what I understand as of now). The benchmarks are suggesting that slowdown will be somewhere between 5%(best case)-30%(worst case).

4. Regarding point 3, syscalls don't matter much. Only thing that matters is how many times syscalls are called. For example, if you are using read() or write() on 8MB buffers, you won't have too much slowdown; but if you are calling same syscalls once per byte, a heavy performance penalty is guaranteed. All processes are which are I/O heavy are going to suffer (hostings and databases are two common examples).

5. The patch can be disabled in Linux by passing argument to kernel during boot; however it is not advised for pretty much obvious reasons.

6. For gamers: this is not going to affect games (because those are not I/O heavy)

Meltdown: "Meltdown" targeted on desktop chips can read kernel memory from L1D cache, Intel is only affected with this variant. Works on only Intel.

Spectre: Spectre is a hardware vulnerability with implementations of branch prediction that affects modern microprocessors with speculative execution, by allowing malicious processes access to the contents of other programs mapped memory. Works on all chips including Intel/ARM/AMD.

For updates refer the kernel tree: https://git.kernel.org/…/ke…/...

For further details and more chit-chats refer: https://lwn.net/SubscriberLink/...

~Cheers~

(Originally written by Adhokshaj Mishra, edited by me. )

The only keyboard i will ever need...

Https://shop.keyboard.io

Con's:
* Steep learning curve
* where the fuck are my key combo's? Ah there they are!

Pro's:
* so comfy!
* much wow!
* such openness
* da blingbling
* wood finish!

Wait what?

(found on twitter: https://twitter.com/janhenrikh/...)

Free ebook: For people who are into hardware analysis, hardware/software design failures.

Hacking the Xbox
by Andrew "bunnie" Huang

It's ofc not state of the art, most techniques apply today still.

Download: http://bunniefoo.com/nostarch/...

maybe some here have a use for such book

Best way to learn a subject/skill is to build projects. How about building your own computer from scratch to learn how computers work.
https://eater.net/8bit/ this tutorial teaches you to build an 8-bit computer from scratch 😍

My newest purchase.

Https://shop.keyboard.io

Hopefully my last keyboard i will ever need

This always gets me:
Developers complaining that their 4 year old / cheap ass computer is slow.

Get. A. New. One.

It's not that hard.
Here, let me do one for you:
https://computeruniverse.net/en/...

I just went to a site that delivers across Europe, and selected a cheap laptop with a decent CPU and SSD. Short on RAM, sure, and without a Windows License. But you can buy RAM for an additional 50$, and that brings you to a total of 550€, delivery included. And it will WORK. And it will be fast.

It's too expensive?
No, not exactly. Wherever you are in the world, if you can code decently, good enough to have the right to complain about development tools, you are eligible to at least 10$ per hour income as a freelancer across the globe. I've had such opportunities offered to me by many organizations, especially non-profit ones that need cheap employees. I actually was offered more but let's stick to 10$ per hour.

So that's 1600$ per month. Enough to buy 3 such laptops. Oh, taxes, I forgot. So you get 2 laptops. Wait! You need food and everything else. Well if you're in a country where that offer actually makes sense, then it's likely that you can live off of 400$ per month quite well. Maybe 800$ if you need to pay rent.
So that's roughly 1 month of work for a laptop that will make you not waste time on waiting for stuff.

Sweet! 1 Month! What does it get me?

Well assuming that you have no laptop, it gets you A JOB that pays you 1600$ per month.
But if you DO have a laptop, you can sell it for cheap, and benefit from the following:
1. Boot-up time from 30-60 seconds to 10 seconds.
2. Installing software - from 1 minute to 10 seconds.
3. Opening a browser - from 10 seconds to 1 second.
4. Opening an advanced text editor (Atom, VS.Code) - from 10 seconds to 1 second.
5. Searching for a file on your entire hard drive - from 1 hour to 2 minutes.
....
You get the point. Waiting is reduced by several times.

So how much do you really wait when coding?

Well are you compiling? Are you opening a new project and the IDE needs to re-index the files? Are you opening programs like a terminal emulator, browser and such? Are you using virtual machines for dev environments?
Well all of these processes become several times faster. Depending on how often you do it, you'll be saving yourself from 1 hour per day to upto 4 hours per day (my case, where a HDD would be just out of the question).

How much is that time worth? At least 10$ per day. If you're working for 20 days per month, 240 days per year, that's a total of 2400$. And for the life time of that crappy laptop of 2 years, that's 4800$ saved. And that's with hugely conservative numbers. Nobody pays 10$ per hour any more, except if you've just started in the industry. I know because I've been there.

Please, for all that's sacred to you, justify right here, right now, HOW THE FUCK can you not afford to get that 8GB of RAM, that cheap ass SSD for 100$, or even a brand new laptop (hey! it's even portable and has FHD graphics on it!) for 550$.

That's why every time I hear someone who is a professional developer complain that they don't have money for a decent machine, I have to ask: why the fuck are you wasting yours and everyone else's time?!