Hard to explain why or how I think the #Meltdown and #Spectre vulnerabilities are hilarious.
It's kinda like a bad joke.
Oops, we accidentally your CPU. Solution: replace CPU
I think it's the conceit of these institutions.
They took shortcuts and optimized one factor at the cost of the others. Maybe it's that #complexity is a real problem and people assume it will work itself out somehow. 🤷♂️
It's an important lesson for the future of computing.
- La faille est exploitée par un ransomware: ❌ - Joli petit nom: ✅ - Faut tout patcher: ✅ - Les concurrents sont aussi vulnérables: ✅ - Linus torvalds tape un drame: ✅ - C'est les Russes: ❌ - C'est l'IoT: ❌ - L'éditeur n'assume rien: ✅ - La NSA savait: ❌ - We are fucked: ✅ - Joli petit nom: ✅ - Le KGB savait pas: ✅ - C'est les chinois: ❌ - Depuis 15 ans: ✅ - On ne sait plus qui doit patcher quoi: ✅ - La team Project Zero nique l'embargo: ✅
In den nächsten Tagen wird es einen kurzen Ausfall geben, um den Server neu zu starten und den #meltdown Patch einzuspielen. Das macht der Provider, weshalb ich keine Kontrolle darüber oder Information habe, wann das passiert.
At some point within the next few days there will be a short downtime for reboot and adding the #meltdown patch. This is done by the provider so I don't have control or information when it will happen.
intel chip bug #meltdown and #spectre. These existed for 10+ yrs. There's theory of intentional NSA backdoor. Not sure i wanna think bout that. But, the question is, how likely is this oversight? i thought intel chip design goes thru proof systems.
> The underlying vulnerability is primarily caused by CPU architecture design choices. Fully removing the vulnerability requires replacing vulnerable CPU hardware.
>> I'm much less worried about these "nospec_load/if" macros, than I am >> about having a sane way to determine when they should be needed. >> >> Is there such a sane model right now, or are we talking "people will >> randomly add these based on strong feelings"?
> There are people trying to tune coverity and other tool rules to identify > cases, and some of the work so far was done that way. For x86 we didn't > find too many so far so either the needed pattern is uncommon or .... 8)
> Given you can execute over a hundred basic instructions in a speculation > window it does need to be a tool that can explore not just in function > but across functions. That's really tough for the compiler itself to do > without help.
> The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault.