@CppGuy go the other way: never update them. new CPUs just aren't worth the trouble.

@millihertz

It takes a reasonably modern CPU to run #Luks at an acceptable speed. Building a system without full-disk encryption these days feels like negligence. But a machine modern enough to have fast crypto instructions will also have the unfathomable complexity that presents a huge attack surface.

@CppGuy There is another route that may not be as simple as deciding to to it. But I thought I mention it because it works well for me: Redefine acceptable. I still like my Core2 Duo laptop. Everything is up to date and LUKS works fine, too. I'll probably switch to a second generation Core i5 soon. And I will love the speed and wonder how I managed to get by before for sure. But so far I'm still happy with it the old one.
Edit: I should mention that I already use the i5 sometimes when I need the extra RAM, e.g. for compiling some things. @millihertz

@steeph

You must be getting better results than I do! My old 2009 Core Duo machine manages about 5MB/sec with Luks enabled.

I'm old. I don't have that much time left. 😄

@millihertz

@CppGuy 5 MB/s is more than 80 times of what USB 2.0 can theoretically manage. That is very acceptable to me. I shouldn't admit that I don't have my home directory encrypted. So I won't. @millihertz

@steeph

Have I told you about my FiL's burglary? The thieves opened up his computer and removed the hard drive. That's all they took.

It wasn't until years later that it dawned on my why they'd done it. He used to run the mailing list for a local sailing club. That hard drive gave the criminals a list of affluent people and days when they were likely to be away from home. Of course, he ran consumer-grade #Windows and #MicrosoftWorks, so nothing was encrypted. I hate to think how much misery and loss that caused.

You can be a target without even realising it. I still don't think FiL knows to this day why he was burgled. And he still doesn't use #encryption. 😟

@millihertz

@CppGuy I'd also worry whether more recent CPUs have more (and not yet widely known and mitigated) flaws, too - maybe we all need to use 5yo CPUs but keep upgrading whenever they reach 7yo!

@kitten_tech

I don't know. A lot of the bugs on that list apply to CPUs that were several years when the bugs were found.

To make things more complex, software mitigations often hurt performance, so a given PC now gets slower over time, even before we account for code-bloat.

@CppGuy sure, but what bugs have yet to be found in the LATEST chips? 🤷

I reckon x86 CPUs are so complex they've crossed the event horizon of always-gonna-be-buggy, and ARM probably isn't far behind. Dunno about RISCV though...

@kitten_tech

Even the #MOS6502 had bugs, so I'm certain you're right, and today's microprocessors (which have eight orders of magnitude more transistors) will always be buggy.

What bugs remain to be published, and how many of them have already been discovered and exploited by the bad guys, we can only guess.

Edit: s/five/eight

@CppGuy
CPU vulnerabilities are better dealt with through hygiene ("know your code") than more complex CPUs.

Are you actually a target / have something worth stealing on your computer?

Are you actively working with malware?

Are you running nightlies rather than Stable?

If you answered "no", these 'flaws' are probably not going to affect you.

Right now, I'm more concerned with one of my SSD or hard drives failing, because it would currently cost ~4X to replace them.

I had a DDR stick develop a fault, and fortunately was able to replace it before the RAMpocalypse was beginning to crest. My two-years-out-of-support machine also didn't require bleeding-edge memory.

@RealGene

The problem with knowing your code is that x86 processors are opaque and dauntingly complex. I suspect they're like C++ templates, in that no one understands them completely. 😄 And we don't know who's researching them for nefarious ends. So we're left guessing how bad the risks are and how best to minimise them.

@CppGuy it’s good news and bad news. The good news: CISC architecture CPUs run their own firmware/microcode to implement a lot of that complexity, and some vulnerabilities can be patched. The bad news: RISC architectures tend not to, thus any chip-level vulnerabilities need a hardware fix.
As an engineer, I tend to the view that the more complex a system or component is, the more failure modes it’s got. Give me RISC any day. To be even more specific, give me ARM 😎

@andrew_meir

Oh, #complexity is one of the perennial tussles between Engineering and Marketing: we always want to simplify, and they want the opposite.