mitigations=off

is IMHO a save thing to do on a single user desktop unless you have nation state level adversaries

I did not expect the “I don’t have anything important enough” excuse on HN.

You do not need to be a nation state to fall victim to sophisticated attacks. Most attacks nowadays are performed by bots indiscriminately blasting exploits to anything they can reach.

Even if state actors were the only ones capable of exploiting Spectre/Meltdown, you could still end up being collateral damage.

Infecting employees at their home computers and then spreading via USB/shared files to work computers is nothing new either.

There are Spectre/Meltdown exploits done in JavaScript, on the browser. You do NOT want to turn off mitigations unless you're in a Faraday cage.

The browsers themselves have implemented quite a few mitigations themselves, for the record.

Spectre only works in the same address space, which is why chrome uses so many processes.

Meltdown hadn't been (publicly) found until 2018 so the same applies. Intel's current offerings are extremely competitive with AMD on many workloads.