From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: Meltdown / Spectre Date: Sat, 06 Jan 2018 15:15:29 -0500 Message-ID: <87vageeobi.fsf@netris.org> References: <874lnzcedp.fsf@gmail.com> <20180106174358.GA28436@jasmine.lan> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42557) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eXusq-0006Ab-Kv for guix-devel@gnu.org; Sat, 06 Jan 2018 15:16:01 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eXusn-0005KU-Ff for guix-devel@gnu.org; Sat, 06 Jan 2018 15:16:00 -0500 Received: from world.peace.net ([50.252.239.5]:49212) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eXusn-0005Jg-B1 for guix-devel@gnu.org; Sat, 06 Jan 2018 15:15:57 -0500 In-Reply-To: <20180106174358.GA28436@jasmine.lan> (Leo Famulari's message of "Sat, 6 Jan 2018 12:43:58 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari writes: > The Spectre bugs have to be fixed per-application for now. As far as I > know, we haven't made any related changes to packages besides > linux-libre. > > Mozilla has released an update that is supposed to mitigate the > vulnerability but I don't if they'll be porting it back to the extended > support release that Icecat is based on. I just backported the Spectre mitigation from Firefox 57.0.4 to IceCat, and pushed it to master here: https://git.savannah.gnu.org/cgit/guix.git/commit/?id=c23243fccd4f73430ca06a862acd33c020c8ed17 I recommend that you upgrade your IceCat packages, and furthermore that you install NoScript and avoid using Javascript except when needed. Mark