Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

marc.info

Post reply on HN
Print view View original

61–70 of 130 posts

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#61

Post by Dylan16807 »

siwatanejo wrote: post #57
cthalupa wrote: post #53

Earlier quoted context omitted.

Except that these bugs were all open on open source operating systems, as well... Do you think Linux wasn't affected by Spectre and Meltdown? That the BSDs aren't? That Xen isn't? Your comment is disingenuous and dangerous.

You're (and most likely all downvoters) completely missing the point. I never said that opensource software is not affected, I said "not being affected as a user". Because opensource software, being peer-reviewed, will never try to exploit a CPU bug. Opensource software is, by default, non-malicious.

> Opensource software is, by default, non-malicious.

So is closed source software.

You seem to be deeply confused about the scenarios people are worried about.

The main ones are 1. untrusted users being hosted 2. javascript off the web.

All the open source in the world doesn't help in either scenario.

You're focused on someone deliberately running a malicious program. But if they do that, these exploits aren't even necessary to do severe harm. It's a marginal scenario at best.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#63

Post by siwatanejo »

Dylan16807 wrote: post #61
siwatanejo wrote: post #57

Earlier quoted context omitted.

You're (and most likely all downvoters) completely missing the point. I never said that opensource software is not affected, I said "not being affected as a user". Because opensource software, being peer-reviewed, will never try to exploit a CPU bug. Opensource software is, by default, non-malicious.

> Opensource software is, by default, non-malicious. So is closed source software. You seem to be deeply confused about the scenarios people are worried about. The main ones are 1. untrusted users being hosted 2. javascript off the web. All the open source in the world doesn't help in either scenario. You're focused on someone deliberately running a malicious program. But if they do that, these exploits aren't even n…

> > Opensource software is, by default, non-malicious. > So is closed source software.

Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected.

> The main ones are 1. untrusted users being hosted 2. javascript off the web.

I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user. WRT 2: that's precisely why I mentioned NoScript. Nowadays the only untrusted software that could be run in your computer if you were using opensource OS and opensource apps exclusively is javascript from the web (which is by default closed source).

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#64

Post by mtgx »

paulhodge wrote: post #20

If only he had come up with a catchy name and a logo, we would have listened.

Yes. This is why it kind of frustrates me to see all the "experts" hate on the naming of bugs. This is how you raise awareness about them, which in some cases could be as important as discovering the bugs (especially if the vendors are unwilling to fix them otherwise - think airline industry, and so on).

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#66

Post by zingmars »

siwatanejo wrote: post #57
cthalupa wrote: post #53

Earlier quoted context omitted.

Except that these bugs were all open on open source operating systems, as well... Do you think Linux wasn't affected by Spectre and Meltdown? That the BSDs aren't? That Xen isn't? Your comment is disingenuous and dangerous.

You're (and most likely all downvoters) completely missing the point. I never said that opensource software is not affected, I said "not being affected as a user". Because opensource software, being peer-reviewed, will never try to exploit a CPU bug. Opensource software is, by default, non-malicious.

Being open source and peer-reviewed doesn't mean software won't have bugs, exploits, or that backdoors can't be hidden in it. 'Peer-reviewed' sounds good on paper, but people can still miss things, be lazy, or not understand the code they are reviewing (but it works, so accept merge!). It's hardly the silver bullet to this problem.

As for your original post - moving to FOSS only is not viable for a lot of people. Linux has no good video-editing software, no good CAD tools, gimp has nothing on photoshop and even Libreoffice is rather lackluster when compared to the MS Office package. On top of that, javascript is used pretty much in every site these days, many of which require javascript to run. You can't seriously expect an average user to manually whitelist javascript in the sites they browse.

If the FOSS world had software that worked for everyone, people would use it. Right now, the only major group this is true for however, are developers. Until this changes there will be no 'year of the Linux Desktop' or whatever.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#67

Post by zingmars »

siwatanejo wrote: post #63
Dylan16807 wrote: post #61

Earlier quoted context omitted.

> Opensource software is, by default, non-malicious. So is closed source software. You seem to be deeply confused about the scenarios people are worried about. The main ones are 1. untrusted users being hosted 2. javascript off the web. All the open source in the world doesn't help in either scenario. You're focused on someone deliberately running a malicious program. But if they do that, these exploits aren't even n…

> > Opensource software is, by default, non-malicious. > So is closed source software. Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected. > The main ones are 1. untrusted users being hosted 2. javascript off the web. I've never talked about (1), of cou…

Your stats need a citation, otherwise they mean nothing. CVE lists have plenty of entries for FOSS software, so it's definitely not '99.whatever' you're claiming.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#68

Post by jacquesm »

siwatanejo wrote: post #34

There's one way to not be affected by these bugs: use an opensource OS along with opensource applications (no, proprietary apps even inside sandboxes don't count). EDIT: oh, and using the NoScript browser add-on :) To all the downvoters: please prove me wrong by replying ;)

You are totally missing the point. A side channel means that someone else on the same host can read your privileged or otherwise inaccessible data. So it is fine if you only use open source and compile everything yourself but what about that other account on the same machine or image? What about that other VM on the same hardware?

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#70

Post by blattimwind »

forapurpose wrote: post #7

At least one of the recent exploits needs to be mitigated at the OS level (I haven't looked at the details carefully, but I know Microsoft and Linux are working on it). Is OpenBSD affected and if so, what are they doing to mitigate it?

It looks like none of the BSDs were in on the embargo, so given the complexity of the KPTI patches for Linux, I'd guess it'll take a while to develop the equivalents.
Post reply on HN