Well, the #Windows (yes, I use Windows... unfortunately...) patches for #Meltdown/#Spectre really do fuckover my PC heavily...

Ran some #benchmarks with them enabled then ran some benchmarks with them disabled...
The difference was 45%!!!???

Seriously, what the fuck... I though my PC was getting outdated af with how slow it is at times but it's just #Microsoft fucking me over again...
Let's hope #Retpoline in W10.1903 will do a better job at this...

#FreeBSD enables support for #retpoline in base: https://svnweb.freebsd.org/changeset/base/339511

#HardenedBSD has had it enabled for a few months for amd64.

The clang/llvm 6.0.0 #retpoline patch landed in #FreeBSD HEAD: https://svnweb.freebsd.org/base?view=revision&revision=328817

It's nice to see it in FreeBSD. This landed in #HardenedBSD a couple weeks back.

Next, FreeBSD needs to switch to ld.lld as the default linker in order to actually make use of retpoline. Since HardenedBSD already switched to ld.lld, we're able to make full use of retpoline.

Importing the retpoline patch is a good first step.

IBRS/IBPB support lands in #FreeBSD HEAD: https://svnweb.freebsd.org/changeset/base/328625

We'll make good use of this in #HardenedBSD, especially since we have #retpoline applied to the entire ecosystem in 12-CURRENT/amd64.

#Spectre #infosec

In the latest #HardenedBSD 12-CURRENT/amd64, #Tor is compiled with:

1. PIE
2. full RELRO
3. CFI (with the cfi-icall scheme disabled)
4. SafeStack
5. #retpoline

If you're looking at deploying a #Tor relay or exit node, please consider deploying on HardenedBSD.

Using HardenedBSD will help keep you, the Tor network, and its users more secure. Let's piss off the bad guys together. :)