11–20 of 296 posts
Considering the performance impact, I wonder how console manufacturers are going to handle this (assuming that the processors they used are vulnerable to Spectre/Meltdown).
It could be still a problem though, considering many console games use all kinds of hacks to barely run at the target resolution/framerate.
Wow that's a huge jump. Scared for my web servers now
Not entirely sure why we need to update/protect most servers, since generally they won't be running untrusted code, right?
For spectre, the consequences of not applying those patches are not as bad but it wouldn’t surprise me if you could still do a lot of harm. PHP is somewhat sandboxes these days (by using chroot and what not) and meltdown/spectre could be used to escape the sandbox.
Considering the performance impact, I wonder how console manufacturers are going to handle this (assuming that the processors they used are vulnerable to Spectre/Meltdown).
Console manufacturers don't run unsigned code, so I expect they'll just sit still until the next hardware refresh.
Earlier quoted context omitted.
If they're operating on data supplied by the attacker, they're potentially a single hop away from executing untrusted code.
...at which point that untrusted code gains full access to the only userspace process that matters on that node. If you gain access to run code on a server process why escalate further, you already have access to everything that matters?... Assuming bare metal. In shared hosting / cloud / VMs it is different.
Earlier quoted context omitted.
Not entirely sure why we need to update/protect most servers, since generally they won't be running untrusted code, right?
The reason for doing so is minimising the risk if an attacker breaks into a server. This is also why systems like ATMs should be patched. Untrusted code execution on servers and ATMs may not be the norm, but it's far from impossible.
Of course on shared servers this is going to be a nightmare.
Earlier quoted context omitted.
Not entirely sure why we need to update/protect most servers, since generally they won't be running untrusted code, right?
The reason for doing so is minimising the risk if an attacker breaks into a server. This is also why systems like ATMs should be patched. Untrusted code execution on servers and ATMs may not be the norm, but it's far from impossible.
there have been ~4600 privledge escalation bugs found since 1999. 250 a year. Almost one every day.
https://www.cvedetails.com/vulnerabilities-by-types.php
At this point we still won't have security and now we won't have performance either.
It's putting the cart before the horse.
Considering the performance impact, I wonder how console manufacturers are going to handle this (assuming that the processors they used are vulnerable to Spectre/Meltdown).
The current consoles are using AMD/ARM processors, probably they aren't affected that much. It could be still a problem though, considering many console games use all kinds of hacks to barely run at the target resolution/framerate.
Considering the performance impact, I wonder how console manufacturers are going to handle this (assuming that the processors they used are vulnerable to Spectre/Meltdown).
And in any case the Meltdown patch is not too bad for games.
Earlier quoted context omitted.
Console manufacturers don't run unsigned code, so I expect they'll just sit still until the next hardware refresh.
Modern consoles now come with web browsers, and the researchers proved that the attacks could be performed via web browsers, did they not?