Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So the unspoken part of your question is when is it useful to turn off mitigations. The answer to that is when your application makes a lot of syscalls / when syscalls are a bottleneck beyond the actual work of the syscalls.

This case, where it's all connection handling and serving a small static piece of data is a clear example; there's almost no userland work to be done before it goes to another syscall so any additional cost for the user/kernel barrier is going to hurt.

Then the question becomes who can run code on your server; also condidering maybe there's a remote code execution vulnerability in your code, or library code you use. Is there a meaningful barrier that spectre/meltdown mitigations would help enforce? Or would getting RCE get control over everything of substance anyway?



if you have an event driven system then end up with very frequent system calls.


Partially that can be amortized with io_uring... At the cost of some complexity, of course.


io_uring was added to linux 5.1, that was in 2019. I have to admit that i didn't yet have the chance to use it. https://en.wikipedia.org/wiki/Io_uring

Did you use io_uring? Is its performance much better than or comparable with using aio_read/aio_write for block io? (i did use async io for block io).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: