Yet another chip-bug variant of Spectre has been uncovered; variant 4 now.

What prompts the penning of this article is the claimed 2-8% performance penalty of the update-fix, which, Intel in this case, (but it also impacts other speculative execution think AMD/ARM too) ships the update with the fix disabled and leaves it up to software developers (think Apple, Microsoft, Redhat) and hardware OEMS (think Dell/HP) to make up their minds whether to enable or disable it thus incurring the “2-8%” performance penalty for something considered (by Intel) difficult to exploit.

Couple noteworthy items here in light of the disclosures (or conversely, lack of disclosures):

First, it’s not clear what hardware/OS revs results in the 2-8% performance penalty. With the original Spectre/Meltdown fixes, the older your CPU/OS rev, the larger the impact as the fixed code isn’t optimized for older, less mainstream supported hardware and software. My guess is say the new Win10/Mac OSX High Sierra running a Kaby Lake or newer CPU results in disclosed 2-8% performance penalty with it being 2% if it’s a video playback or synthetic benchmarks and 8% if it’s browsing the web or Office-like apps, or something along those lines. However, I’d be willing to bet Skylake/Broadwell/Haswell/older CPUs could see a larger hit then the disclosed 2-8%, or be on the 8% side of the spectrum. Likewise, Win7/8/8.1 and older MacOSes could see a larger hit.

Second point (although really it’s a digression of the 1st point), what about your smartphone? Possibly more then 2-8%, probably a lot more on the mobile side as I’ve noted Spectre/Meltdown fixes to date are largely memory protection/isolation mitigations which raise the memory footprint of processes running on the patched widget, and since those platforms are already memory-starved for power efficiency reasons (the flagship iPhone X has only 3GB for example), they’re (probably) going to see some more substantial performance hits post-update. There’s just no way around it other than to not enable it as RAM is RAM (not even addressing processing overhead efficiency which is part if not all of the 2-8% obviously), hence why I can see Intel/AMD not enabling it by default instead letting other folks make up their mind depending on which platform it’s going on to enable it or not. That Netbook that sports 2 to 4GB probably is a good candidate to leave it off: it’s a low-reward target (for the bad guys) that has high impact on it’s performance (low memory-availability).

At any rate, the more folks like Intel and AMD reassure me it’s only a small 2-8% performance hit, the more I take those reassurances with a grain of salt when what they’re doing (shipping it off) says opposite of the message they’re trying to send of it being a small deal.

Do I plan to update? Yup. Don’t hear what I’m not saying here. Not patching is unwise, unless you have a good reason, which there are very good reasons, but, said good reasons are the exception, not the rule.

Now does it make sense for everyone to update? To Intel and AMD’s point, maybe not. Depends what you’re running and how juicy of a target it is. Amazon’s EC2 backbone is obviously a juicy target, but a netbook probably isn’t. That said, I don’t think it’s just 2-8% for everyone though is the devil in the details here, especially smartphone implementation.