“Intel Core 2 bugs will assuredly be exploitable from userland code” (2007)

Post by forapurpose » Fri, Jan 05, 2018, 11:48 PM UTC

GalacticDomin8r wrote: post #74

forapurpose wrote: post #28

Earlier quoted context omitted.

> Industry experts have been expressing concerns for this for ten years. AFAICT, de Raadt was concerned about Intel in general, but not the recent exploits in particular. We can find endless criticisms of every major company from the last 10 years (including on HN!); picking this one mailing list posting is bit arbitrary in the context of these exploits, even if de Raadt makes some good general points.

They were more than general points. Please don't poo-poo this as some sort of horoscope doom and gloom post. He specifically pointed out the the issues addressed in the recent disclosures: > It is not just buggy, but Intel has gone further and defined "new ways to handle page tables" (see page 58). The MMU, page tables, and TLB are all directly related.

Post by forapurpose » Sat, Jan 06, 2018, 12:16 AM UTC

tedunangst wrote: post #118

forapurpose wrote: post #27

Earlier quoted context omitted.

> probably doing what everybody is doing for mitigation Is there any discussion? I thought OpenBSD development mostly took place on public mailing lists ?

Some issues tend to attract a lot of lookie loos. The patch probably won't be improved by a dozen replies about the incompetence of intel.

Post by drvdevd » Sat, Jan 06, 2018, 5:23 AM UTC

dannyw wrote: post #38

wasx wrote: post #22

Earlier quoted context omitted.

>They can a handle a bit of criticism from a bunch of nerds on HN. What a reductive and shortsighted evaluation of the situation. Can they handle the loss of faith from big companies? Can they handle the loss of faith from the entire tech community? Seems to me that AMD et al have now got the perfect opportunity to erode intels market share and build up a large market base amongst cloud providers etc (not to mention…

AMD’s x86/x86-64 Cross licensing agreement terminates if they ever have more than X (I think 30% or 50%) of the desktop and server market share, so I don’t think so. The agreement purposefully gimps AMD as a minority player.

Post by siwatanejo » Sat, Jan 06, 2018, 10:55 AM UTC

zingmars wrote: post #66

siwatanejo wrote: post #57

Earlier quoted context omitted.

You're (and most likely all downvoters) completely missing the point. I never said that opensource software is not affected, I said "not being affected as a user". Because opensource software, being peer-reviewed, will never try to exploit a CPU bug. Opensource software is, by default, non-malicious.

Being open source and peer-reviewed doesn't mean software won't have bugs, exploits, or that backdoors can't be hidden in it. 'Peer-reviewed' sounds good on paper, but people can still miss things, be lazy, or not understand the code they are reviewing (but it works, so accept merge!). It's hardly the silver bullet to this problem. As for your original post - moving to FOSS only is not viable for a lot of people. Lin…

Post by acct1771 » Mon, Jan 08, 2018, 6:27 AM UTC

jerf wrote: post #85

jokoon wrote: post #78

I know I will sound like a conspiracy theorist, but can those bugs be intentional? I mean if you are a security agency, would it be possible to push for the introduction of such bugs?

Occam's Razor suggests to me that intelligence agencies have not had to push for processor bugs, on the grounds that A: we can adequately explain the initial existence of these bugs by normal engineering, marketing, and management considerations such as almost everyone here has experienced personally and B: the field of the bugs that come from my first point is so ripe that the intelligence agencies are better served…