Leo Famulari <leo@famulari.name> writes:

> ### Guix status ###
>
> The CPU makers are issuing microcode updates as a hardware-level
> mitigation, but I don't think we'll be providing those in Guix.

It seems some (but not all) mitigations may require firmware/microcode
updates.  For details, see:

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf
https://developer.arm.com/support/security-update

I wonder: how easy will it be to install those firmware/microcode
updates if you are using GuixSD?  In particular, I'm curious about the
case of the Lenovo x200 with libreboot, since that's what I use
personally.

> The first mitigations available in Guix are in the kernel.
>
> We got the initial mitigation for Meltdown, Linux page table isolation
> (KPTI), in linux-libre 4.14.11 on January 3:
>
> https://git.savannah.gnu.org/cgit/guix.git/commit/?id=10db5e98ed7036e873060501462345c37fe2855c
>
> Last night we got KPTI for the 4.4 and 4.9 kernel series, in 4.4.110 and
> 4.9.75, respectively. At the same time, we made 4.14.12 available, which
> has some changes to KPTI in that kernel:
>
> 4.4.110:
> https://git.savannah.gnu.org/cgit/guix.git/commit/?id=630437d94eeeae52586ab2362aa4273e0424cdf3
> 4.9.75:
> https://git.savannah.gnu.org/cgit/guix.git/commit/?id=f2462bc3662733801d7df7c532c1d8b0c67b3c18
> 4.14.12:
> https://git.savannah.gnu.org/cgit/guix.git/commit/?id=af3f7f22f43fbbdca9bdc00afc476dd2ac86c017

That's great!

> Mozilla has released an update that is supposed to mitigate the
> vulnerability but I don't if they'll be porting it back to the extended
> support release that Icecat is based on.

My understanding is that those changes just mitigate the known methods
for the Spectre attack via Javascript.  Surely, other ways will be
discovered and abused, until a more holistic fix for Spectre is in
place.  See also the following paper, which claims to have found
alternative ways to mount similar attacks:

https://gruss.cc/files/fantastictimers.pdf

Probably, the safest thing one can do right now is disable Javascript by
default and judiciously enable it only for websites that you trust.

-- 
Chris