231–240 of 298 posts
BTW, removing the kernel from the non-privileged address space seems like such a great idea (which is not a new one at all) the whole thing should probably should have some hardware support to be made fast.
Earlier quoted context omitted.
there's a subset of the web that still remains a hypertext document database (the 'web 1.0' if you will) instead of becoming an application delivery platform (web 2.0, i hear it's almost out of beta). going JS-less on wikipedia is possible and not at all a bad experience.
Sure if you limit your life to Wikipedia that's fine. Hell, you don't even need an internet connection for it. Just download it all once in a while. But the rest of us like using places like Amazon, Slack, Google Maps, etc. I fully support not making content delivery rely on JS. But I disabling JS because it can be used for intrusive ads is a lot like taking the wheels off your car because it can take you to the mall…
Earlier quoted context omitted.
>It's a feature, not a nefarious backdoor that the NSA made Intel include under the cover of darkness. Let's be clear: It's both.
Is it? Again, that a big claim to make in five words and drop the mic. Can you cite anything to back it up?
You request a proof that's impossible to procure. Are you now gonna claim the lack of this proof supports your thesis?
Earlier quoted context omitted.
>OK, but that's (a) 100% speculation 95% speculation. The last 5% comes from exercising basic pattern recognition. I remind you that we're probably talking about interference from the organization that arranged this: https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... The existence of that program was pure speculation, until it turned out to be totally real. >(b) fails Hanlon's razor. This is completely i…
I think they have an incompetent management department that decided that no open sourcing ME is a good idea. Marketing is may also be incompetent at picking up the pieces after the bugs were discovered. > 95% speculation. The last 5% comes from exercising basic pattern recognition. No, it's all speculation because pattern recognition is not evidence, as applied here. Like, is it possible that I am an NSA agent trying…
Why aren't you viewing the possibility of intelligence agencies ordering the Intel ME as one of these future historical facts? If the proof for that became known today, both the agency and Intel would scramble to introduce a better backdoor in the next generation CPUs / MBs and devise a marketing campaign to make it sound good -- and to bash their former selves for "making a mistake" while simply thinking "OK, we're gonna cover it up much better this time and we're gonna twist it in such a way that people would flock to buy it". It's what marketing and spies do; they twist facts. Why is that so non-legit for you?
Furthermore, you're asking why didn't they do a better job if it was a conspiracy. People in closed circles aren't exposed to public criticism and their thinking is affected in the process. They usually think "meh, good enough, nobody will ever find it anyway". They are humans like you and I and are susceptible to bad days or negligence due to being tired. Furthermore, it's very likely they were under pressure to make it work quickly so they took shortcuts. What makes you think the programmers of the intelligence agencies have godlike powers over their (very likely) military superiors? Answer is, they don't. Programmers have no executive powers and their counsel is usually met with skepticism if it doesn't fit the management's agenda.
When talking about intelligence, our best bet is to do educated guesses. If we had hard facts we would be targets. As mentioned in another reply of mine directed at you -- it's their job to hide the facts. So you requesting proof of these matters is basically refuting all possibility of intelligence agency commission of the Intel ME on the grounds of "hey, you are not the next Edward Snowden so your arguments are invalid".
Meh. You come across as a guy who basically says "my speculation is better than yours". Not constructive.
Earlier quoted context omitted.
AMD doesn't exactly do an amazing job of avoiding gotchas in their CPUs. They have a bizarre idea of what writing zero to a segment register should do (resulting in info leaks that were only recently fixed on Linux), their demented leaky IRET is even more demented than Intel's, and their SYSRET's handling of SS is downright nutty. OTOH, Intel's SYSRET is actively dangerous and has resulted in severe security holes, a…
Can you post a few links maybe to the SYSRET issue mentioned? Just curious.
Earlier quoted context omitted.
there's a subset of the web that still remains a hypertext document database (the 'web 1.0' if you will) instead of becoming an application delivery platform (web 2.0, i hear it's almost out of beta). going JS-less on wikipedia is possible and not at all a bad experience.
JS is part of the web - going JS-less under the guise of security seems fruitless to me. Even if I went JS-less, it would be very difficult for me to convince anyone with access to privileges on my life to go JS-less as well. A JS exploit could affect my parents which would in turn affect me. A JS exploit could affect my doctor/lawyer/bank teller which could affect me. I'm not sure what the advantages of this argumen…
And this is not gonna change before a huge paradigm shift in network protocols and network apps.
Earlier quoted context omitted.
Right now, they just own you and your data. With this, they will own your machine.
Pretty extraordinary that a user's most important files (their documents and whatever else is in their home folder) are accessible to any app at any time. Why are we still using this outdated security model? On Windows, I could download an .exe and it could upload the entire contents of my Dropbox without even prompting for elevation or anything. Kinda scary when you think about it.
Because it's convenient. The alternative would be something like flatpak's portals, which funnel everything through a few standardized dialogs; but how would you for instance use them to implement a media player application which scans for mp3 files, reads their tags, and presents them on a list? A "select a directory" portal dialog either would not allow for a recursive scan, or risk a non-technical user selecting their home directory, and either way would be a strange interruption in the workflow. (I understand, however, that Android has done precisely that for removable SD cards...)
Essentially looks like Intel compromised (whether intentional or not is a different point) the design to get the speed boost that gave them the lead over AMD for the past decade. Will be interesting to see how all this plays out.
If it wasn't intentional, then it wasn't a compromise. So it's not a different point.