You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Untrusted code mitigations are on by default in V8. Having them on regresses performance. --no-untrusted-code-mitigations disables them and fixes the regression.
@mcollina you said earlier that the flag does not work for you. Did you find out why?
@mcollina you said earlier that the flag does not work for you. Did you find out why?
@hashseed I used an older binary, I wrongly guessed that the files were sorted, but they weren't.
Untrusted code mitigations are on by default in V8. Having them on regresses performance. --no-untrusted-code-mitigations disables them and fixes the regression.
What I mean is, can we flip this behavior in Node.js against V8? It seems they are not part of Node.js threat model, so we can live without them and enjoy better performance.
after we set DISABLE_UNTRUSTED_CODE_MITIGATIONS, can users still do something like --enable-untrusted-code-mitigations
Yes and no. It sets the default value for the flag, so you can still use --untrusted-code-mitigations to enable it. However, V8 compiles some of its builtin code at build time to include in the startup snapshot. Once included, the runtime flag won't be able to change it anymore. These builtin code are also affected by mitigations. Though I expect that the performance impact to be less significant. But the fact these builtins do not include mitigations may be a security risk if that's an issue.
@hashseed knowing what you just said, should we instead compile with untrusted code mitigations and disable them by default when Node starts (with v8.setFlagsFromString)?
You'll probably need this on 6.5 as well. I'm not so eager to have untrusted code mitigations build into the Node snapshot. I think it's better to consistently disable them via the GN/GYP flag. If someone needs a Node with these mitigations, he/she should build a proper binary. We're already stretching the test matrix quite a bit here...
Activity
targos commentedon Mar 7, 2018
@nodejs/v8
ofrobots commentedon Mar 7, 2018
Can you also try with
--nountrusted_code_mitigations(link)?mcollina commentedon Mar 7, 2018
I downloaded an old canary build, I'm now on node-v10.0.0-v8-canary20180306870146ff63-darwin-x64.
master (not sure why but I can't replicate the numbers I had this morning):
with
--nountrusted_code_mitigations:without
--nountrusted_code_mitigations:Essentially yes,
--nountrusted_code_mitigationsfixes it. What does that do?(With the new release I can't replicate the effect on http, which is good)
ebraminio commentedon Mar 7, 2018
Spectre and Meltdown related mitigations, not needed for usual use of node.js AFAIK.
mcollina commentedon Mar 7, 2018
oh nice. Can we flip the switch to have
--untrusted_code_mitigationsinstead?Or is this already happening on master?
hashseed commentedon Mar 7, 2018
Untrusted code mitigations are on by default in V8. Having them on regresses performance.
--no-untrusted-code-mitigationsdisables them and fixes the regression.@mcollina you said earlier that the flag does not work for you. Did you find out why?
mcollina commentedon Mar 7, 2018
@hashseed I used an older binary, I wrongly guessed that the files were sorted, but they weren't.
What I mean is, can we flip this behavior in Node.js against V8? It seems they are not part of Node.js threat model, so we can live without them and enjoy better performance.
hashseed commentedon Mar 7, 2018
Yes. The best way to do this is to add GYP configs to pass
DISABLE_UNTRUSTED_CODE_MITIGATIONSas C++ define, to mirror this GN config.devsnek commentedon Mar 7, 2018
after we set DISABLE_UNTRUSTED_CODE_MITIGATIONS, can users still do something like
--enable-untrusted-code-mitigationsmcollina commentedon Mar 7, 2018
@hashseed Would this be needed on V8 6.6? Should we do this change after nodejs/node#19201?
hashseed commentedon Mar 7, 2018
Yes and no. It sets the default value for the flag, so you can still use
--untrusted-code-mitigationsto enable it. However, V8 compiles some of its builtin code at build time to include in the startup snapshot. Once included, the runtime flag won't be able to change it anymore. These builtin code are also affected by mitigations. Though I expect that the performance impact to be less significant. But the fact these builtins do not include mitigations may be a security risk if that's an issue.Ideally as part of the PR to update V8 to 6.6, yes.
targos commentedon Mar 7, 2018
@hashseed knowing what you just said, should we instead compile with untrusted code mitigations and disable them by default when Node starts (with
v8.setFlagsFromString)?hashseed commentedon Mar 7, 2018
Yes, that sounds good.
bmeurer commentedon Mar 8, 2018
You'll probably need this on 6.5 as well. I'm not so eager to have untrusted code mitigations build into the Node snapshot. I think it's better to consistently disable them via the GN/GYP flag. If someone needs a Node with these mitigations, he/she should build a proper binary. We're already stretching the test matrix quite a bit here...
mcollina commentedon Mar 16, 2018
This can be closed then