An incredibly low probability multiplied by ~billion+ users means somebody is going to lose something valuable sooner or later. And then the odds of MS getting sued for “not even patching a well-known vulnerability” becomes 100%.

But that's also a billion+ users with much slower computers! So you need to compare the harm on both sides.

And then MS could add a switch in Settings for anyone who is concerned. (I realize not many people would find it, but it seems important for the option to be accessible, without digging into the registry or some such.)

Think of the average windows user. This person uses Chrome because they got a popup when they went to Gmail. The shortcut for candy crush is still in their start menu because it doesn't bother anything. I am not being insulting -- this is the average, median windows user. This is the person for whom Windows Home is designed. There is ZERO CHANCE that this user knows what a "speculative execution mitigation" is. There is a nonzero chance some cleaner site will tell them to turn it off because it "makes windows faster". They don't understand it can be executed from a website because they don't think of websites as programs because they don't have an icon on the desktop. There is no way this turns out well.

Yes, so Microsoft has to make the decision for them. I'm not sure "we're going to make your computer 30% slower because there's a 0.0001% chance someone could steal your password" is the right decision.

(These numbers are completely made up. Any decision would depend on getting the right numbers, but this appears to be easier said than done. I've seen very different estimates.)

An unpatched data exfil against the OS with the largest install base in the world? It doesn't matter it's a byte at a time, cryptominers have done more with less. The question isn't if, the question is who and how many. The fallout from SMB2 is still ongoing, and it was patched 10 years ago. The idea of not patching EVER opens up harms for the next twenty years for everyone.

> The fallout from SMB2

This made me wanna cry. Jokes aside, there's much truth to this. Attack vectors at this scale are seriously dangerous.

I'm still hoping we can prevent the namewreck fallout of SCADA systems, because at one point or another, 8200 is gonna make a mistake with their offensive cybersec operations.

What is the chance that this user has unbacked up data that someone could extort them for $500. Multiply this chance by the proportion who would enable a "go faster" option and then by 1.5 billion computers.

Let us say 20% and 25% * 1.5B. Maybe 75M targets give or take depending on how you want to do the math.

> But that's also a billion+ users with much slower computers! So you need to compare the harm on both sides.

Far more likely Microsoft would be legally exposed due to a skipped patch than a patch that slows machines down. Intel on the other hand, that'd be more interesting.

> And then MS could add a switch in Settings for anyone who is concerned. (I realize not many people would find it, but it seems important for the option to be accessible, without digging into the registry or some such.)

Any such switch would just be disabled via GPOs by corporate security teams anyway, so what's the point? The entities who would most "benefit" wouldn't even be able to do it.

To be clear, I am very explicitly thinking of home editions of Windows. No GPOs.

There's already third party tools (0) to disable those mitigations in windows. I suspect the small barrier to entry of needing to use a search engine is enough to keep the risk minimized to the general population. Hopefully only people who are knowledgeable of and willing to accept the risk use this.

0: https://www.grc.com/inspectre.htm

If you could trivially enable a "go much faster" setting in the gui that would in turn make you much more vulnerable you would see people sharing on facebook how they found the secret go faster option and 1/4 of machines would have this setting enabled rendering exploiting it much more profitable and you would see attacks become widespread after which people would ask why windows came with a suicide switch. This issue comes to a head when somewhere some important company or 3 is attacked via possibly poorly managed employee laptops enabling this feature after when the gui option is deleted. Then someone can have the same 5 years later after people have forgotten about the first go round.

How about we just skip a step?

I’m not suggesting Microsoft does this intentionally to push consumers to buy new computers because that is obviously not the primary motivator for the mitigation patches, but I’m sure they don’t mind.

Also your average user isn’t going to know or understand even if you gave them the option somewhere. It just doesn’t make sense.

If you are knowledgeable enough to understand, then you can disable the mitigations. This seems like the best approach to me for everyone.

Spectre and meltdown aren’t often used because of the mitigations in modern operating systems. The attacks are complex and the chance of finding a vulnerable machine is low. But if instead windows users were all vulnerable, you bet all sorts of scammy websites would go after these vulnerabilities.

And the attacks are really bad - they can read arbitrary memory. What are the chances another browser tab has a bank website open with active auth cookies, or a valuable email account? Really really high.

> And the attacks are really bad - they can read arbitrary memory.

But—and please tell me if I’m just totally wrong about this—my understanding was they can read random memory, right? The attacker can’t control what they get.

Out of the gigabytes of memory on a system, I’d expect only a handful of bytes to be actually valuable, and only then if certain combinations can be retrieved together.

The term “Random memory access” is a horribly confusing misnomer from before I was born. It’s used as a contrast with sequential memory access, to mean memory can be accessed in any arbitrary order.

My understanding is that these vulnerabilities allow reading the memory at arbitrary mapped pointers, from the perspective of the CPU, in kernel or user space. So you could use the kernel’s data structures to figure out what other programs are mapped, and where, and go read their memory.

Until there's an actual documented in the wild attacks against individuals, I see zero reason to enable these crippling security measures on my home desktop.

Isn't the fact that mitigations are widely deployed the primary reason why there aren't substantial attacks in the wild?