• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.
  • The forums have been upgraded with support for dark mode. By default it will follow the setting on your system/browser. You may override it by scrolling to the end of the page and clicking the gears icon.

Do you disable hyperthreading? (poll)

Do you disable hyperthreading?

  • Yes

    Votes: 11 6.1%
  • No

    Votes: 169 93.9%

  • Total voters
    180
No.
Simply because I use AMD Ryzen :D
 
Last edited:
that 7700K in ur specs definitely looks like a ryzen :p

it's my laptop. i use my laptop just for running/testing a simple model before my ryzen do the rest.

honestly, i wanna buy a new laptop powered by Ryzen 3750U/3550U for my wife.
 
Lex, the RIDL whitepaper pdf from the "experts" does state javascript is a potential vector, FWIW.
But they did state it is possible.
Einstein stated that time travel is technically possible too.
There is no POC yet, true. And it may even be impractical.
Based on what I've read and understand, the way that JS would have to be configured in order for an attack vector to work would render JS unusable by a browser for general browser functions. Impractical indeed.
 
In my work computer I have HT turned off because Autodesk programs don't do multithreading (with small exceptions that are not applicable to me). 4 or 6 cores are sufficient, and with HT off, CPU gains a little more headroom on the clock.

We leave it on as AutoCAD work generally requires the use of several other programs and activities. These include:

1. One or more spreadsheets for performing engineering calculations.

2. Word processor for reading / editing specs and placing sections in Drawings

3. Several web pages listing manufacturers dimensions details, downloading CAD details.

4. Work generally doesn't follow typical "working hours so when the 12-1 lunch period arrives, most are in the "middle of something" and working when the incremental lunch toime backup runs.

Things is ... if the box can game, it's usually well into the "more than you need" category for AuotoCAD. In 1999 AutoCAD was what determined componentry, now gaming does (assuming of course not doing rendering / anmation) . Gaming cards perform far better than the Pro Workstation cards in 2D and 3D Drafting. Back in the day, I remember spending $1k for a 7200 rpm SCSI drive to speed up AutoCAD's extensive disk writes and w/o memory management tools you, were oft left staring at the screen for significant times. But today, besides opening the program and opening gigantic files, the only bottleneck we have is the user's input speed. But even that "isn't real" because ...

Step 1 - Open program / Open file
Step 2 - Review marked up drawing while Step 1 occuring

Im usually ready to proceed about a minute or 2 after the file is waiting for me.

We've yet to experience any impact on workflow . Each box has at least 4 BIOS profiles choosable at boot

1. Stock BIOS profile ... troubleshooting
2. Moderate OC ... games that don't behave well
3. Max OC w/ HT .... everyday usage
4. Max OC w/o HT ... need that last few fps.

Have not see AutoCAD productivity change in any way regardless of the number of cores or the CPU multiplier. Our users, me more than most :) ... that's the only bottleneck. We don't do any rendering. The type of work we do doesn't need to "be sold" w/ pretty images (Plant design / MEP / Site design) .... but I have built boxes for those that do and they like the extra cores ... and workstation cards.


For curiosity's sake, I have tried disabling cores for various exe files ... Starting with all 8 cores assigned to the exe, I'' start with 8 and knock them off 1 at a time, I have yet to see any program or game I own affected by dropping down to 3 cores.

It could take years to find them, and years more for it to be released.

By then, there's a 50-50 chance I'll be dead..... but by then there's a 99% chance my current equipment will be in a landfill somewhere.... if not, I'll worry about it then. Whether or not you can create a js script that does damage is only the 1st step ... it has to get thru the ISPs, get thru our firewall, get thru malware protection and get past the user's brain.
 
Last edited:
I haven't bothered disabling it, haven't had any virus's or dodgy exploits happen for years. I run my browser in a sandbox, and am fairly discriminative in what I download so shouldn't be an issue.
 
Based on what I've read and understand, the way that JS would have to be configured in order for an attack vector to work would render JS unusable by a browser for general browser functions. Impractical indeed.

The paper states that stock browser configurations including webassembly are sufficient. That's every modern browser as they ship.

I run my browser in a sandbox

Breaking out of sandboxes is kind of what this does.

it has to get thru the ISPs, get thru our firewall,

No, it doesn't. The whole idea of javascript is it runs locally from a website you visited.

I am not trying to cause panic as I still feel with no in the wild attacks the risk remains low. But a lot of this misinformation is addressed in the first couple chapters of the RIDL whitepaper pdf. Let's not parrot blatant mistruths if we can avoid it.
 
Last edited:
Let's not parrot blatant mistruths if we can avoid it.

I gave up. You have to remember who knows everything and who doesn't.
 
If someone want to avoid any performance loss what he should avoid updating ? Both Intel microcode updates and OS updates ? Does updating the OS alone will still cause performance loss?

HT is always enabled.
 
I gave up. You have to remember who knows everything and who doesn't.

I'm sorry, is this aimed at me?

If you want citations, it's all here:


Look at "Javascript attacks."

I do not know everything. But I read the paper, which is a start (that's also how I discovered my yahoo group ripped their code from here, lol). I don't understand half of it but some of these things are said in pretty darn plain English that directly contradict what's being said here. And this is from the people who literally discovered the exploit.

I need to read the other papers. That's just RIDL and it was a pretty heavy read so haven't done the others yet.

If someone want to avoid any performance loss what he should avoid updating ? Both Intel microcode updates and OS updates ? Does updating the OS alone will still cause performance loss?

HT is always enabled.

You'd want to stay away from the new microcode. So no new bios. Eventually thought the OS updates will likely force it upon you via mcupdate. I'd suggest to quit now, it's a losing battle.

And no, I don't really approve of that but... it is what it is. Unless your literally running something like Gentoo I can't advise ways to avoid this post Microsoft issuing a mcupdate.

Oh, by the way, they posted this on the homepage now:


It's one unprivileged process pulling a string right out of another processes memory in real time, in javascript, for those who don't understand what they are seeing. It's done in a console but the docs tell us this could be applied anywhere.
 
Last edited:
You'd want to stay away from the new microcode. So no new bios. Eventually thought the OS updates will likely force it upon you via mcupdate. I'd suggest to quit now, it's a losing battle.
So pretty much I’m going to need to update my system to an i9 in order to not lose any eventual performance from forced fixes. :shadedshu:
 
So pretty much I’m going to need to update my system to an i9 in order to not lose any eventual performance from forced fixes. :shadedshu:

I don't think they could force ht off where is most of the impact would come from. How the older archs like ours fair from these microcode updates vs newer archs I don't know. I'm bailing for Zen 2 so it doesn't really matter to me.
 
So pretty much I’m going to need to update my system to an i9 in order to not lose any eventual performance from forced fixes. :shadedshu:

I don't agree with forced fixes but I think this one does have the potential to become serious as it's better researched. I'd take this one but leave hyperthreading on. Seems the happy medium.

There may be a way to avoid it by using the VMWare microcode experiment driver (freeware) to forcibly downgrade your microcode. I could make a package to do that if it proves to a be a non-signifigant vulnerability. Give it a month or three and we'll see. I won't do it now in case this does somehow blow up and I inadvertently contribute to the downfall of the western computing world or something...

I don't think they could force ht off where is most of the impact would come from. How the older archs like ours fair from these microcode updates vs newer archs I don't know. I'm bailing for Zen 2 so it doesn't really matter to me.

My next build will be Zen 2 as well (for a change of scenery if nothing else, lol).

Just no reason right now because even with all the fixes this thing still is fast enough for what I do at the moment.

Nope. You'll find the same thing. Correct information doesn't matter.

It does, to some. That's all I care about.

That or I'm incredibly stubborn. Guess which is more likely. :roll:
 
Last edited:
Well, use your pc smart in general, not clicking any suspicious ad/link/attachement. Maybe you can use a scriptblocker to avoid js as much as possible, enabling only selected, trusted site. Than firewall, router settings. And if someone is after you, they can do it many other way, you can just slow them.
 
Well, use your pc smart in general, not clicking any suspicious ad/link/attachement. Maybe you can use a scriptblocker to avoid js as much as possible, enabling only selected, trusted site. Than firewall, router settings. And if someone is after you, they can do it many other way, you can just slow them.

While those good policies and all but the problem is XSS. Numbers suggest up to one in three sites are vulnerable to XSS attacks which means perfectly trust worthy sites get taken advantage of by bad actors. Your firewall and router likely won't help you either unless they have great packet inspection abilities which I would not bet money on.
 
Breaking out of sandboxes is kind of what this does.

Bah, I'll have to try it in a VM instead, would that be safer by any chance?
 
Bah, I'll have to try it in a VM instead, would that be safer by any chance?

Nope. The whole thing is pretty leaky as far as WHERE data can be pulled.

The good news is mitigation seems way less harmful than turning HT off.
 
Back
Top