Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meltdown, aka “Dear Intel, you suck”

marc.info

Post reply on HN
Print view View original

131–140 of 176 posts

Re: Meltdown, aka “Dear Intel, you suck”

#131

Post by hah-muh-rabbi »

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

It's OpenBSD, what else to expect? This is the result of them not respecting embargoes. All they have left is to vent.

Re: Meltdown, aka “Dear Intel, you suck”

#132

Post by kuschku »

JdeBP wrote: post #121
kuschku wrote: post #42

Earlier quoted context omitted.

FreeBSD was told in December, which is still a realistic timeline.

Late December, i.e. a week or so before the cat actually got let out of the bag, and probably around a fortnight's notice until the originally planned coördinated announcement date. * https://news.ycombinator.com/item?id=16074531 That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six month…

> That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017.

Correct, but it’s significantly better than OpenBSD’s timeline (which learnt about it from the media). Mitigation for Meltdown is possible within of a week, or two. It requires working through the night, but it’s possible.

Mitigation after it’s in the media is a whole different situation.

Re: Meltdown, aka “Dear Intel, you suck”

#133

Post by p49k »

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

Is outrage not the way that almost anything moves forward these days? I feel that if not for the internet (the modern version where anyone has the ability to publish something that can be seen by many, regardless of tech knowledge) that we would be utterly powerless. It’s one of the few things that causes large organizations to actually care about anything. It’s almost an obligation these days.

Re: Meltdown, aka “Dear Intel, you suck”

#134

Post by hah-muh-rabbi »

bonzini wrote: post #74
forgotpw2018 wrote: post #73

Earlier quoted context omitted.

All other chipmakers are 'immune' to Meltdown precisely because the attack is obvious. Cache timing is hard, but speculating execution before checking permissions is plain dumb. If it was such a mythical attack why doesn't it work on anyone else's chips? Intel screwed up hard on this and I have no sympathy. Hopefully the incoming lawsuits will make up for the massive amount of money wasted for the performance losses

The most recent ARM chips (cortex A75) are vulnerable.

Sadly that doesn't fit OpenBSD's "Intel you suck" narrative.

Re: Meltdown, aka “Dear Intel, you suck”

#135

Post by dentemple »

tokenizerrr wrote: post #122
tomkat0789 wrote: post #87

Hi I'm a mostly average Linux user just now learning about these hardware vulnerabilities as I'm planning on building a new computer. What new processor should I buy that has the best chance of being safe when all this dust clears? I first posted this question on a thread about Intel ME. Have processors always been this tricky security-wise or are these low level exploits we're finding a recent phenomena?

Wait a few months if you can.

More like two years.

Re: Meltdown, aka “Dear Intel, you suck”

#136

Post by Khoth »

K0nserv wrote: post #59
betterunix2 wrote: post #37

Earlier quoted context omitted.

AMD's microarchitecture does not perform speculative loads that would cause a segfault, according to this AMD engineer: https://lkml.org/lkml/2017/12/27/2

> We also tried to reproduce the Meltdown bug on several ARM and AMD CPUs. However, we did not manage to successfully leak kernel memory with the attack de- scribed in Section 5, neither on ARM nor on AMD. The reasons for this can be manifold. First of all, our im- plementation might simply be too slow and a more opti- mized version might succeed. For instance, a more shal- low out-of-order execution pipeline could t…

The section 3 toy example is demonstrating that OOO execution can cause instructions after a faulting instruction to be speculatively executed, but in that example the subsequent instructions do not depend on the result of the faulting instruction.

AMD's claim is that the result of the faulting instruction can never end up affecting a later speculated instruction - ie, for Intel the bad access says "here's the value you asked for" and later says "actually you don't have permission, forget you saw that". For AMD the bad access says "you don't have permission, so no result available"

Re: Meltdown, aka “Dear Intel, you suck”

#137

Post by hah-muh-rabbi »

tomxor wrote: post #116
jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

The three big BSDs aren't exactly obscure, they might not have the highest server market share compared to windows and linux but they are the next on the list and often a primary choice for a variety of companies critical infrastructure, the most commonly sighted example these days is netflix. I think the outrage is justified.

Don't mistake this as OpenBSD's concern for all BSD's. This is just OpenBSD rant because they isolated themselves by not respecting embargoes in the past. Some ARM CPU's are also vulnerable by the way.

Re: Meltdown, aka “Dear Intel, you suck”

#138

Post by akerro »

hanniabu wrote: post #35
sverige wrote: post #21

Earlier quoted context omitted.

OpenBSD has struggled at times to pay their power bills. They don't have the resources to branch off into building new hardware from first principles.

Hopefully there are some tech savvy new crypto millionaires that are willing to help contribute to worthy projects such as this.

Yea, why don't you start?

Re: Meltdown, aka “Dear Intel, you suck”

#139

Post by discoursism »

temprature wrote: post #67
Tomte wrote: post #47

Earlier quoted context omitted.

Don‘t they refuse to honor embargoes? That would be an explanation why they got no information privately.

They don't like embargoes but they don't go out of their way to break them. The only embargo I know of that OpenBSD broke was for OpenSSL, and that was an honest mistake, as explained here: https://www.tedunangst.com/flak/post/regarding-embargoes There was another "incident" with the KRAK embargo, where OpenBSD got permission to silently patch it early and then the researcher who found it regretted giving them permis…

I guess if they made an explicit statement that they will comply with embargoes going forward, they'll be able to correct the record. But I don't see that that has happened. Lots of egos have to get out of the way, maybe?
Post reply on HN