Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel CEO: Patches will come to 90% of chips in the next week

techcrunch.com

Post reply on HN
Print view View original

21–30 of 137 posts

Re: Intel CEO: Patches will come to 90% of chips in the next week

#21

Post by maltalex »

nickysielicki wrote: post #12
maltalex wrote: post #10

Earlier quoted context omitted.

Yeah, well, let's not break out the champagne yet. According to your link: > The BIOS (or UEFI) updates the CPU microcode during boot, however most of the time either the motherboard vendor won't issue frequent BIOS/UEFI updates, or the user won't install such updates. For these reasons, the system processor is likely to be running with outdated microcode on a vast number of systems. We still need the various manufac…

I think that claim is incorrect. I'd be surprised if Windows Update didn't download and load updated vendor microcode, and most Linux distributions do (or can), too. At least, I know Fedora does it by default.

I'm sure they would if that's possible. But if microcode can only be updated by the BIOS, you'd need a BIOS update.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#22

Post by [deleted] »

nickysielicki wrote: post #12
maltalex wrote: post #10

Earlier quoted context omitted.

Yeah, well, let's not break out the champagne yet. According to your link: > The BIOS (or UEFI) updates the CPU microcode during boot, however most of the time either the motherboard vendor won't issue frequent BIOS/UEFI updates, or the user won't install such updates. For these reasons, the system processor is likely to be running with outdated microcode on a vast number of systems. We still need the various manufac…

I think that claim is incorrect. I'd be surprised if Windows Update didn't download and load updated vendor microcode, and most Linux distributions do (or can), too. At least, I know Fedora does it by default.

[deleted]

Re: Intel CEO: Patches will come to 90% of chips in the next week

#23

Post by nickysielicki »

maltalex wrote: post #21
nickysielicki wrote: post #12

Earlier quoted context omitted.

I think that claim is incorrect. I'd be surprised if Windows Update didn't download and load updated vendor microcode, and most Linux distributions do (or can), too. At least, I know Fedora does it by default.

I'm sure they would if that's possible. But if microcode can only be updated by the BIOS, you'd need a BIOS update.

Microcode can definitely be loaded by the OS.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#24

Post by herpderperator »

maltalex wrote: post #10
nickysielicki wrote: post #5

Earlier quoted context omitted.

https://wiki.debian.org/Microcode The real news here is that Intel thinks they can fix this via microcode. This is surprising because initially there were some strong arguments that this wouldn't be possible.

Yeah, well, let's not break out the champagne yet. According to your link: > The BIOS (or UEFI) updates the CPU microcode during boot, however most of the time either the motherboard vendor won't issue frequent BIOS/UEFI updates, or the user won't install such updates. For these reasons, the system processor is likely to be running with outdated microcode on a vast number of systems. We still need the various manufac…

Microcode is updated by OSes as well as BIOSes. I explained this in a previous thread: https://news.ycombinator.com/item?id=16075376

Re: Intel CEO: Patches will come to 90% of chips in the next week

#25

Post by jokoon »

I wonder what will the next big security hole.

I'm becoming very pessimistic about how I can trust computers.

Computers can do amazing thing, but software seems fragile, unreliable and untrustworthy.

I have been keeping notes on paper for years now, and it doesn't look like it's going to change.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#26

Post by nickysielicki »

glandium wrote: post #20

I thought they already provided a microcode update?

Latest version on downloadcenter.intel.com is 20171117; no microcode update has been published since Spectre/Meltdown have been disclosed.

edit: see below, not true; they haven't published it on their own site but have pushed microcode updates to redhat.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#27

Post by bcantrill »

This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any OS that isn't Windows, MacOS or mainline Linux), that work is ongoing and will depend on the OS. (Speaking for SmartOS/illumos, that work is reasonably far along and making promising progress -- but we don't yet have a functional prototype.)

As for Spectre, these are just the microcode updates that have the additional MSRs that allow system software to mitigate certain variants of Spectre attack against the system software itself. They are necessary, but emphatically not sufficient -- and it would disingenuous for Intel to pretend that this in any way means that 90% of systems are protected from Meltdown and Spectre.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#28

Post by guelo »

What I'm worried about is that it will be hard to avoid these security patches when you don't need them. Say you have a non-virtualized, non-shared server that only runs your own trusted code. I don't want to be forced to pay the performance penalty but it might be unavoidable without resorting to maintaining your own linux fork.
Post reply on HN