✨ Feature Suggestion | Better explain the CPU vulnerability section #1669

New Issue

2020-01-28T11:41:35Z

Mikaela commented

2020-01-28 11:41:35 +00:00

(Migrated from github.com)

Description

https://www.privacytools.io/operating-systems/#cpuvulns

Reddit points out that we don't have any explanation on what are CPU vulnerabilities and why the user should care about them, only instructions to enable mitigations on Linux.

https://www.reddit.com/r/privacytoolsIO/comments/etj0vf/what_is_remember_to_check_cpu_vulnerability/

## Description * https://www.privacytools.io/operating-systems/#cpuvulns Reddit points out that we don't have any explanation on what are CPU vulnerabilities and why the user should care about them, only instructions to enable mitigations on Linux. * https://www.reddit.com/r/privacytoolsIO/comments/etj0vf/what_is_remember_to_check_cpu_vulnerability/

Mikaela commented

2020-01-30 13:17:46 +00:00

(Migrated from github.com)

Microcode package is not installed by default in all systems, including Debian that we list as a recommended OS, and the distributions also vary a lot on whether they enable all mitigations or what do they do with hyperthreading.

Security violations through hardware vulnerabilities are possible including remote code execution or malicious software managing to get access to information it's not supposed to access leading also to privacy violation.

From our recommendations Tails also uses full mitigation and I believe it's better the more widely the issue is discussed about.

@privacytoolsIO/editorial Thoughts?

Microcode package is not installed by default in all systems, including Debian that we list as a recommended OS, and the distributions also vary a lot on whether they enable all mitigations or what do they do with hyperthreading. Security violations through hardware vulnerabilities are possible including remote code execution or malicious software managing to get access to information it's not supposed to access leading also to privacy violation. From our recommendations [Tails also uses full mitigation](https://tails.boum.org/contribute/design/kernel_hardening/) and I believe it's better the more widely the issue is discussed about. @privacytoolsIO/editorial Thoughts?

nitrohorse commented

2020-02-08 19:19:30 +00:00

(Migrated from github.com)

Hmm, these are some good points raised; thanks @CHEF-KOCH. I do agree that this section could use some re-thinking and simplification. The current information is still valuable but maybe isn't the right fit for the general PrivacyTools audience. 🤔

Hmm, these are some good points raised; thanks @CHEF-KOCH. I do agree that this section could use some re-thinking and simplification. The current information is still valuable but maybe isn't the right fit for the general PrivacyTools audience. :thinking:

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#1669