How will libreboot deal with Meltdown and Spectre?

Then, by "freedom and security" you mean immunity to hackerdom, and not to instutional intelligence (Intel and various intelligence services they possibly cooperate with).

Because, with a proprietary µcode and architecture, all those CPU's were already compromised when they are first sold. Meltdown and spectre opens your system to hackers, but it was already open to Intel for years. And the µcode update libreboot might provide or not will not protect you against Intel (and their accomplices) but only against the hackers.

So the question is rather simple, really. Which is;

"Shall I continue to be open to just Intel et.al. (with µcode update), or shall I be open to *both* Intel and hackers (without µcode update)?"

> with a proprietary µcode and architecture, all those CPU's were already compromised

That is, with or without ME.

"The first thing is, that it is in my opinion a mistake to assume that only proprietary software can contain malicious code."

Although that's not what I said now, was it? I referred to running "proprietary programs that they can never audit or trust." The difference being that, if someone were stupid enough to put something into a free program that makes use of the Spectre exploit, we here in the free world will make a modified version and remove it.

"you have to review the code every time before you execute it"

I don't know why this would necessarily have to be the case. I can't speak for other people's computers, but the software on my computers is not changing without my knowledge. So if I run a program and then come back to it 5 minutes later and run it again, it is the same program. Perhaps this could be a thing to consider when applying updates from someone's distro, but really only if someone's threat model included the notion that the distro might themselves ship them malicious programs. But the notion of the distro itself shipping such things is a separate matter. Such a thing would, of course, make news like Ubuntu did when they started sending local search terms out over the internet and help people question if they should even use that distro or not.

"The second thing is, that most sites in the internet are not useable without JavaScript."

You must be using a different internet than I do. If something can only be used with proprietary software and can't be used with free software then I question whether it should be used at all. But I understand that different people will come up with different answers to that because not everyone is willing to give up their proprietary software. But I digress because but this is a separate matter from finding ways to avoid Meltdown and Spectre. My original point remains. But, if someone were to absolutely insist "No! I must continue to deliberately cause these problems for myself", there are still other options too without having to resort to proprietary microcode changes. Someone could, for one possibility, have a physically separate machine dedicated to such things (preferably on a physically separate network) without any confidential stuff on it in case some program makes use of the Spectre exploit to grab it. And they always treat the machine as if it were root-compromised. But, as we see here, this would be part of the building up walls to defend against attacks that I was talking of earlier. It can be simpler to remove onesself from the situation in the first place, which is what I was originally talking about.

Of course I don't pretend these to be the only solutions for how someone might address the issues raised by Meltdown and Spectre without using proprietary software. Another might be using a computer with a CPU that doesn't have speculative execution. I think there was a thread here somewhere about that. Feel free to join in and help come up with more solutions. Solutions was what the original question was about anyway. ;)

>javascript

Well, FF was patched for metdownz. You can also mitigate spectre by disabling jit in your browser - linky ->

https://trac.torproject.org/projects/tor/ticket/21011

*I can count the websites I allow javashit to run on the fingers of my left hand. You get used to it, get much faster browsing, safer and much much more functional - if a website requires js to display text and images I simply move over.