Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

marc.info

Post reply on HN
Print view View original

101–110 of 130 posts

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#101

Post by endorphone »

mannykannot wrote: post #91
endorphone wrote: post #77

Earlier quoted context omitted.

" he had identified specific issues that he believed would eventually get exploited " But those aren't the issues that were exploited. His post has absolutely nothing to do with the current issues. It's just uninformed dogpiling (the ignorance of the crowd). All chips have errata. This post is not particularly informative or relevant to anything.

This is not the ignorance of the crowd, it is the insight of one informed individual. Dismissing as irrelevant all concerns except those that have already been exploited would be closer to being "the [self-inflicted] ignorance of the crowd" in these matters.

Everyone fishing around for anyone saying anything about Intel chips ever, and then trying to shoehorn it into a current narative is the ignorance of the crowd. Every single chip has errata. In this case Theo is pointing at Intel's own list of defects in a revision/chip, which is profoundly unilluminating, and is completely and absolutely irrelevant.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#102

Post by rdtsc »

mannykannot wrote: post #93
rdtsc wrote: post #4

Earlier quoted context omitted.

I am sure Intel will be fine. It is effectively a monopoly in the desktop and server market and enjoyed their position and profits for years. They can handle a bit of criticism from a bunch of nerds on HN. Maybe loading data speculatively across a protection boundary was careless. It seems besides the latest ARM CPUs no other vendor went that route. But not owning up to it and issuing PR statements saying "This works…

Saying "it is not a flaw, it is working as designed", when that design has led to a demonstrated exploit, marks one as either clueless or duplicitous. Why would a company as large as Intel choose to present itself as such? I guess it thinks we are too dumb to notice (Intel did say it is not a flaw in its press release; I don't know whether it explicitly tried the "working as designed" excuse, but the no-flaw claim by…

My guess is that the memo, besides the marketing channels was also filtered through the legal department and they advised not to admit guilt as they probably expect to be sued at some point. Then a clear admission on their part would be slam dunk.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#103

Post by pdpi »

endymi0n wrote: post #48
mrep wrote: post #46

Earlier quoted context omitted.

That and off by one errors ;)

Concurrency You forgot 2) Cache invalidation and 3)

I’d risk saying we’re all intensely aware how hard Cache invalidation is, right now

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#105

Post by dboreham »

protomikron wrote: post #72
alex_duf wrote: post #71

Earlier quoted context omitted.

That would be great. I know nothing about low level programming, and I'm wondering if webassembly couldn't be a good place to start designing CPU instruction sets? Can someone more competent on the matter tell me if this idea is crazy?

> Can someone more competent on the matter tell me if this idea is crazy? Yes, it's crazy. :) But seriously, the ISA (instruction set architecture) is not the problem, but the optimizations (deep pipelines and speculative execution, etc.) are.

The nature of the ISA can influence the kinds of optimizations undertaken.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#106

Post by evanmoran »

taneq wrote: post #73
tracker1 wrote: post #51

Earlier quoted context omitted.

The two most difficult things in software development. * naming things * cache invalidation * off by one errors

It's always worth having it stated in the canonical form. :)

The fifth hardest thing is figuring out the canonical form :)

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#107

Post by drvdevd »

jerf wrote: post #85
jokoon wrote: post #78

I know I will sound like a conspiracy theorist, but can those bugs be intentional? I mean if you are a security agency, would it be possible to push for the introduction of such bugs?

Occam's Razor suggests to me that intelligence agencies have not had to push for processor bugs, on the grounds that A: we can adequately explain the initial existence of these bugs by normal engineering, marketing, and management considerations such as almost everyone here has experienced personally and B: the field of the bugs that come from my first point is so ripe that the intelligence agencies are better served…

We now know there are many conspiracies in our industry wrt national intelligence but I agree with you- this is probably not one of them.

Why ask for a bug when you can just sit back and wait for them?

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#108

Post by mannykannot »

rdtsc wrote: post #102
mannykannot wrote: post #93

Earlier quoted context omitted.

Saying "it is not a flaw, it is working as designed", when that design has led to a demonstrated exploit, marks one as either clueless or duplicitous. Why would a company as large as Intel choose to present itself as such? I guess it thinks we are too dumb to notice (Intel did say it is not a flaw in its press release; I don't know whether it explicitly tried the "working as designed" excuse, but the no-flaw claim by…

My guess is that the memo, besides the marketing channels was also filtered through the legal department and they advised not to admit guilt as they probably expect to be sued at some point. Then a clear admission on their part would be slam dunk.

That is probably so, though if it came to being sued, I guess the plaintiffs' counsel would be ready to point out the flaws in that line of thinking.

On the other hand, Intel's stock price did recover in response, reversing the somewhat panicked or speculative drop earlier in the day, so perhaps this was mainly for the market.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#109

Post by mannykannot »

endorphone wrote: post #101
mannykannot wrote: post #91

Earlier quoted context omitted.

This is not the ignorance of the crowd, it is the insight of one informed individual. Dismissing as irrelevant all concerns except those that have already been exploited would be closer to being "the [self-inflicted] ignorance of the crowd" in these matters.

Everyone fishing around for anyone saying anything about Intel chips ever, and then trying to shoehorn it into a current narative is the ignorance of the crowd. Every single chip has errata. In this case Theo is pointing at Intel's own list of defects in a revision/chip, which is profoundly unilluminating, and is completely and absolutely irrelevant.

The issue is not that the errors existed, but the risk some of them presented. Theo correctly identified an area where the risks were greater than generally recognized.

Re: “Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

#110

Post by busterarm »

agumonkey wrote: post #100
busterarm wrote: post #98

Earlier quoted context omitted.

> We should fund a tiny group for sane cpu design. It's happened, again and again. The ARM CPUs powering your phones are a good example. Maybe with more of a market, POWER9 prices might come down.

Half recent application class arm core are affected. They are saner but the problem is still here

I was more trying to point to RISC in general ("RISC is good" https://www.youtube.com/watch?v=wPrUmViN_5c). What I really wanted to say is that we've tried but RISC hasn't really been successful in the (mass consumer) market, which because of ARM is only partially true.

In truth you're correct, and ARM is sort of an unruly mess at this point, but that's a much larger discussion.

Post reply on HN