Meltdown, aka “Dear Intel, you suck” • Hacker News Board

Re: Meltdown, aka “Dear Intel, you suck”

#171

Post by cookiecaper » Sun, Jan 07, 2018, 2:09 AM UTC

sverige wrote: post #96

bonzini wrote: post #85

Earlier quoted context omitted.

They would have had to delay it for a year or more.

So the decision was, go ahead and release it even though we know it's vulnerable because we'll make more money that way than we would if we took the time to fix it and make it secure? If so, I hope the market punishes that decision mercilessly.

To be fair, Coffee Lake is presumably faster/better and not more vulnerable than other chips [0]. If you have to mitigate anyway, and you're desperate to get back to pre-mitigation performance parity, releasing a faster chip that still requires mitigation could be a reasonable option.

[0] Caveat: Skylake and later are extra-vulnerable to Spectre because they have even more aggressive speculative execution, but fortunately, the IBRS microcode update is roughly equally performant as retpoline on Skylake+ only.

Re: Meltdown, aka “Dear Intel, you suck”

#172

Post by emn13 » Sun, Jan 07, 2018, 10:05 AM UTC

xucheng wrote: post #75

emn13 wrote: post #70

Earlier quoted context omitted.

These classes of attacks are not new. Timing attack in crypto have been widely used for a long time. And even specifically in CPU's there was stuff like http://www.daemonology.net/papers/htt.pdf and http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190... over ten years ago(!) . To quote that last paper: > We show how processor architecture features such as simultaneous multithreading, control speculation and…

Yes, I am aware of them and agree with you. In fact, cache-miss side channel attacks are known by academics for years as well. However, this is the first time someone combining various of previous techniques (timing, cache-miss, speculative loading etc.) together to make this attack work. Quote from the meltdown paper: > We expect that Meltdown and Spectre open a new field of research to investigate in what extent pe…

Right, so to stick a label on it: the exploit is novel, the vulnerability is not.

Why does that matter? Because people seem to imply intel isn't to blame here; that since the attacks were unforeseen, it's essentially just bad luck. But that's not the case: the risky bits of architecture were known. It's like finding a memory corruption vulnerability and then deciding not to fix it since you don't also know of an exploit - that's just being careless.

Furthermore; finding holes like this isn't some divine act; although there is luck and skill involved there's no question that others can do so too. Even if an attack were completely new, you have to ask yourself how hard it was to find. Does a supplier have any responsibility to provide secure things? Then they should be looking for these kinds of holes. Obviously to a novice any hack like this looks almost magical - but there's a risk that by interpreting any novel attack as not-their-fault that the vulnerable supplier never bothers trying to make anything secure.

Intel was being careless. They should definitely have known this was exploitable even without knowing how to exploit it. And it's at least conceivable that they could have found this or an exploit like this if they had tried.

Re: Meltdown, aka “Dear Intel, you suck”

#173

Post by emn13 » Sun, Jan 07, 2018, 10:14 AM UTC

apcragg wrote: post #68

emn13 wrote: post #54

Earlier quoted context omitted.

Spectre is somewhat reasonable; at least some variants are forgivable. Meltdown isn't. The risks due specifically to speculation and cache timing attacks (and lots of related stuff) were well known and documented for over a decade. They shouldn't have been speculating across memory protection boundaries, and they should have known that - even if it was unclear exactly how one might exploit such information leakage.

If it is so well known why has it taken 20 years to be discovered?

It didn't take 20 years to be discovered; PoC's for variations on this theme were found over 10 years ago.

The details really matter for making an exploit: so the amount of speculation and what gets speculated, how caches work, how good timing is (and how large the difference between cache and memory is) etc.

Merely knowing that the combination of speculation, caching, and timing have the potential to break through memory protection barriers is a far from enough to actually exploit that weakness.

For comparison: it was widely known that sha1 had weaknesses, yet it took many years for somebody to construct two pdfs that actually demonstrate a hash collision.

Re: Meltdown, aka “Dear Intel, you suck”

#174

Post by ric2b » Mon, Jan 08, 2018, 2:27 PM UTC

mwambua wrote: post #108

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

While I think the story's title could be more mature, I think that the outrage in the article is justified. Intel didn't notify any of the BSD teams of the vulnerability during and after the embargo period, leaving anyone running a BSD vulnerable for a longer period after the disclosure. IMO, it's a good thing that this issue gets publicity... if only so that the 'lesser' open source projects don't get ignored in the…

I might be wrong but wasn't it BSD that a few months ago released information on a critical vulnerability before the embargo was lifted?

I think it was the WPA2 handshake vulnerability.

I remember people saying that BSD would probably no longer receive information about embargoed vulnerabilities because of that.

Re: Meltdown, aka “Dear Intel, you suck”

#175

Post by 2trill2spill » Tue, Jan 09, 2018, 10:28 PM UTC

ric2b wrote: post #174

mwambua wrote: post #108

Earlier quoted context omitted.

While I think the story's title could be more mature, I think that the outrage in the article is justified. Intel didn't notify any of the BSD teams of the vulnerability during and after the embargo period, leaving anyone running a BSD vulnerable for a longer period after the disclosure. IMO, it's a good thing that this issue gets publicity... if only so that the 'lesser' open source projects don't get ignored in the…

I might be wrong but wasn't it BSD that a few months ago released information on a critical vulnerability before the embargo was lifted? I think it was the WPA2 handshake vulnerability. I remember people saying that BSD would probably no longer receive information about embargoed vulnerabilities because of that.

> I might be wrong but wasn't it BSD that a few months ago released information on a critical vulnerability before the embargo was lifted?

BSD is not an operating system unless your referring to the original Berkley Unix. Are talking about FreeBSD?, OpenBSD?, NetBSD?, DragonflyBSD? Remember they are all different operating systems.

Re: Meltdown, aka “Dear Intel, you suck”

#176

Post by jschwartzi » Fri, Jan 12, 2018, 3:26 PM UTC

jacquesm wrote: post #114

jschwartzi wrote: post #106

Earlier quoted context omitted.

What about on ARM?

Has QNX been ported to ARM? Interesting! edit: apparently it has been: http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=%2F...

I'm using 6.5.0 SP1 in an ARM-based project. The documentation on their Screen graphics stack leaves something to be desired but otherwise it's a reasonably competent system.