it's the fault of Intel, why don't they recall all the CPU? just like vehicle company
I want to be there for question 099.
Meltdown Update Kernel doesnt boot
71–80 of 205 posts
Re: Meltdown Update Kernel doesnt boot
#72Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks.
"biggest" by number of affected CPUs? very possibly, yes. the march of time has that effect: there are more cpus potentially and actually affected, worldwide, than at any other time in history. "biggest" by net financial loss to a single entity? I dunno. How much did that failed NSA launch cost the state again?
> failed NSA launch
I didn't hear about that one
Re: Meltdown Update Kernel doesnt boot
#73Re: Meltdown Update Kernel doesnt boot
#74Earlier quoted context omitted.
I watched that spy demo. How does it know what memory location contains the password being typed?
I'm assuming if you know either common byte patterns or string patterns you might be able to figure out where the password string is being allocated and watch that area of memory for changes.
Not sure if Meltdown is the same, but I read that Spectre can recover memory at about 10kb/sec. So it wouldn't be very efficient to scan the entire memory for a known pattern.
I suppose if there was an exploit targeted at a specific program, it would be possible to work out what location the secrets are stored in?
Re: Meltdown Update Kernel doesnt boot
#75Earlier quoted context omitted.
I can't imagine a court doing anything. The cost to intel is simply to high, and its not like they were negligent given that ARM/POWER/etc are all vulnerable to some extent too. This whole thing is the equivalent of discovering that if someone throws enough nails on the road your car will blow a tire, spin out of control and kill you. With the kneejerk reaction of trying to fill everyone's tires with concrete to avoi…
Actually, it is more like that someone can throw a rock through a car window and then compromise the car door lock. Or, probably more accurately, that a hitchhiker can knock you out of the car, and drive off with it. Spectre/Meltdown ONLY is an issue if you run some untrusted code on your system. If you avoid this, there is not problem. Yes, we like to be able to run untrusted code (such as in a web browser / javascr…
I'm with you on the untrusted code bit, which is why I think unmapping the kernel should be restricted to untrusted processes. Then it only applies to your browser, the KVM/qemu instances or whatever runs untrusted code.
Yup, this will hit the EC2/etc users hard, but those people have already IMHO given up on absolute performance by putting themselves in shared environments where bad neighbor syndrome can already hit their perf pretty badly.
But for whatever reason (probably because its easier) the current plan just seems to be to use the big hammer.
Re: Meltdown Update Kernel doesnt boot
#76I was under the impression that Ubuntu would automatically revert to last good kernel of the new one fails to boot. Was I mistaken?
No, you have to manually restart, boot into grub and select the one that works
Re: Meltdown Update Kernel doesnt boot
#77it's the fault of Intel, why don't they recall all the CPU? just like vehicle company
Faulty vehicle it's a potential accident with multiple casualities vs a hacked computer with potential loss of your private emails or whatever.
Re: Meltdown Update Kernel doesnt boot
#78Earlier quoted context omitted.
>Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. It must be up there amongst the greats, probably with the "halt and catch fire" op code. Normally they just patch this stuff with microcode and never really tell anybody, this time that won't work. I'm not entirely convinced it was a mist…
I think it's absolutely unreasonable to imply that this was intentional. Besides the massive amount of complexity these systems have, there are plenty of "legitimate" places to hide backdoors, instead of in a performance architecture decision. Keep in mind that whatever "evil agencies" would have asked for this would most likely find themselves vulnerable, and nobody would sign off on. I do agree, however, the "secur…
> I think it's absolutely unreasonable to imply that this was intentional.
Amen. It blows my mind that some people think clever techniques like speculative or out-of-order execution must've somehow how nefarious intentions behind them. Come on HN...
Re: Meltdown Update Kernel doesnt boot
#79Re: Meltdown Update Kernel doesnt boot
#80it's the fault of Intel, why don't they recall all the CPU? just like vehicle company
Are you suggesting that we recall the great bulk of modern CPU's? Like, literally gut everyone's computers, including those in data centers and running critical infrastructure, until replacements are eventually manufactured? Or did you mean something else?
Boxed Intel processors carry a 3 year warranty. It certainly seems reasonable for everyone who bought a CPU within the last 3 years to expect a warranty replacement with the manufacturer defect fixed.
In the EU virtually every product comes with a 2 year warranty. So every CPU sold in the EU in the last two years should be replaced for free by Intel, even through OEMs.
I wonder what potential class action lawsuits Intel might be facing.