Meltdown Proof-of-Concept • Hacker News Board

Re: Meltdown Proof-of-Concept

#41

Post by Acen » Tue, Jan 09, 2018, 7:06 PM UTC

MacOS is yet to have a patch for 10.12.6 (Sierra) to resolve this.

Re: Meltdown Proof-of-Concept

#42

Post by lewapkon » Tue, Jan 09, 2018, 7:07 PM UTC

Acen wrote: post #41

MacOS is yet to have a patch for 10.12.6 (Sierra) to resolve this.

You mean 10.12.6

Re: Meltdown Proof-of-Concept

#43

Post by devy » Tue, Jan 09, 2018, 7:09 PM UTC

Acen wrote: post #41

MacOS is yet to have a patch for 10.12.6 (Sierra) to resolve this.

Did you get the PoC built on macOS? I can't get it built on El Capitan.

Re: Meltdown Proof-of-Concept

#44

Post by mwambua » Tue, Jan 09, 2018, 7:09 PM UTC

btb wrote: post #40

mwambua wrote: post #33

Earlier quoted context omitted.

Nice tool. Sadly, it reports that my browser (Chromium 63.0.3239.132 with strict site isolation (chrome://flags/#enable-site-per-process) enabled) is vulnerable to Spectre. Do you know if there are any other steps that I can take to secure myself aside from using Firefox?

I'm running the same version of Chrome(with site isolation enabled), its reporting "Your browser is NOT VULNERABLE to Spectre" for me. Also in incognito mode with extensions disabled.

Thanks! It reports the same thing for me too now. I had to enable Top document isolation (chrome://flags/#enable-top-document-isolation) as well.

Re: Meltdown Proof-of-Concept

#45

Post by pyvpx » Tue, Jan 09, 2018, 7:16 PM UTC

blablabla123 wrote: post #39

HugoDaniel wrote: post #37

Earlier quoted context omitted.

Except if you are into *BSD. In that case you might want to label it "selective disclosure" instead of "responsible disclosure".

Yeah, if you're not using Linux/Windows/macOS, this sucks. I wonder what happens next. Either alternative OSs for Desktops/Servers will become less popular or people are moving away from Intel chips. Obviously Intel CEO's betted on the latter - stocks are a representation of the future value of a company. Last year I was already hoping that ARM Chromebooks would become more popular but in reality you cannot find them…

probably because Intel doesn't look too fondly at companies who make ARM motherboards.

I believe it's high time the long history of anticompetitive actions by Intel end, and their near/effective monopoly in major market segments be regulated.

Re: Meltdown Proof-of-Concept

#46

Post by Xylakant » Tue, Jan 09, 2018, 7:22 PM UTC

HugoDaniel wrote: post #37

adjkant wrote: post #15

Earlier quoted context omitted.

I think for a bug this big it is pretty understandable. So far, it seems clear the actions of all involved were in a good spirit of responsible disclosure.

Except if you are into *BSD. In that case you might want to label it "selective disclosure" instead of "responsible disclosure".

Well, since some of the BSD folks publicly stated that they’d ignore any embargo, that seems like a pretty predictable consequence. And in this case I understand that it took a while to develop workable mitigations. Immediate disclosure might have caused great harm.

Re: Meltdown Proof-of-Concept

#47

Post by Acen » Tue, Jan 09, 2018, 7:22 PM UTC

lewapkon wrote: post #42

Acen wrote: post #41

MacOS is yet to have a patch for 10.12.6 (Sierra) to resolve this.

You mean 10.12.6

Ah yes, thanks.

Re: Meltdown Proof-of-Concept

#48

Post by JdeBP » Tue, Jan 09, 2018, 7:33 PM UTC

adjkant wrote: post #15

ehPReth wrote: post #14

Earlier quoted context omitted.

I wonder what happened to "This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public." Executive meddling? Edit: Probably the 'extreme circumstances' bit mentioned in https://news.ycombinator.com/item?id=16108434

I think for a bug this big it is pretty understandable. So far, it seems clear the actions of all involved were in a good spirit of responsible disclosure.