Can we please have an architectural MSR to disable TSX?
More Intel speculative execution vulnerabilities
111–120 of 262 posts
Re: More Intel speculative execution vulnerabilities
#112Earlier quoted context omitted.
Or like java applet. Oracle has killed java applet by not handling security issues in a responsible manner.
To be fair the entire approach was flawed and should have been abandoned in favour of SELinux plus something like seccomp years before.
Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.
Re: More Intel speculative execution vulnerabilities
#113Earlier quoted context omitted.
Yeah I'm looking into upgrading my 6500 to a Ryzen 3 3600. It's a shame there's no B550 boards yet.
From what we've seen so far B550 is pretty much just x470 (no PCIE4). And B450, B350 boards will do fine running a 3600. I don't really see a point waiting for B550.
It's mostly just that I'm afraid I'll order a board that isn't on the latest bios, which will be a headache.
And an excuse to postpone.
Re: More Intel speculative execution vulnerabilities
#114Earlier quoted context omitted.
> This place is what Hewlett-Packard was probably like in 2000 (with the printer monopoly), the collapse is coming, but without starting over there is no way to fix it. Interestingly, that printer monopoly seems to be doing fine today, given how I have to go to hp.com to get drivers for my Samsung printer.
Hewlett-Packard was an electronic engineering, semiconductor, and computing company from the beginning (the first product they sold was an audio distortion analyzer, it used a creative circuit to achieve high performance at minimum cost), they used to do serious and innovative R&D. There were the glorious days when Hewlett-Packard makes state-of-art test equipment and semiconductor devices, developed in-house enterpr…
HP? You mean Agilent-Keysight-HP? :p
They’ve split up into companies that are widely successful in each of their individual fields.
Re: More Intel speculative execution vulnerabilities
#115Earlier quoted context omitted.
To be fair the entire approach was flawed and should have been abandoned in favour of SELinux plus something like seccomp years before.
Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.
How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...
Re: More Intel speculative execution vulnerabilities
#116Earlier quoted context omitted.
Not very likely: the attacker is outside the emulated vulnerability-free sandbox, and the state of the emulator is exposed like the state of any other program. Accessing the emulator's memory means accessing the emulated program's memory, it's just slightly obfuscated.
How is the attacker outside, assuming it's a process running on the emulator (I.e. the attacker surface here in the emulator example would be only the NES game, so he has to work with NES cpu opcodes, NES memory locations etc)?
The attacker is not a process running on the emulator, not even if you assume it is. Security is about the worst case, not about hit or miss partial solutions.
Re: More Intel speculative execution vulnerabilities
#117Earlier quoted context omitted.
The timing precision thing by itself doesn't twarte anything, it just makes the attacks harder or take more time. The browser vendors themselves said this; and it's not a permanent solution as tech such as Stadia and WebVR rely on high precision timers. But, whatever man, I'm telling you that it's stupid and you want to bury your head in the sand. You just make these attacks more likely; I'm not going to be impacted…
>The timing precision thing by itself doesn't twarte anything, it just makes the attacks harder or take more time. Oh, so it just takes more time, so you have knowledge of an exploit? Fine, show me any PoC or similar bypassing the lower accuracy and site isolation. You are such a big part of the problem with how this whole class of exploits have been handled. No technical knowledge, just spewing stuff like "You're th…
Except that the Spectre paper already takes degraded timers into account and suggests to use a Web Worker thread that increments a value in a loop as a replacement.
This is not misinformation, _you_ are spreading "certainty" of safety surrounding a dangerous idea.
https://spectreattack.com/spectre.pdf
Even if I was wrong, and very wrong, why the hell would you choose to be less safe? this whole thread chain is absolutely baffling. Buy an AMD CPU or leave the mitigations on. Everything else is needlessly opening yourself up.
Re: More Intel speculative execution vulnerabilities
#118Earlier quoted context omitted.
Thankfully AMD is making serious headway and will continue to take market share from Intel. It will take time but Intel should begin to feel the sting soon.
I'm nearly 20 years in mid to large companies, I've never seen an AMD cpu on a desktop, laptop or server. Its almost like nobody ever gets fired for buying Intel.
I'm 30+ years in. AMD shipped huge numbers of 8086/8088s as a second-source; you might have had one and not known it. But I'm guessing that's not what you mean. :-)
There was a good bit of time where Opterons where everywhere on servers, including things like the whole Sun x86 line. At one gig we had datacenters full of IBM blade servers stuffed with dual Opteron boards; they were a big success in the market. I know at one point another gig's non-US folks had significant installed base of AMD-based Fujitsu servers.
Didn't see as much on the desktop/laptop side, though I did carry a AMD-based Thinkpad for a short while. Apparently HP sold a successful, low-end, AMD-based business desktop.
YMMV...I think it's a matter of 'I haven't seen any tigers in my back yard, therefore I doubt they exist'.
Re: More Intel speculative execution vulnerabilities
#119Earlier quoted context omitted.
I wonder if it might not come to bite them though. Doing it this way means that the media will constantly keep talking about yet another vulnerability in Intel CPUs for years. There's a chance that Intel might and up picking a reputation like Flash did for being insecure.
Or like java applet. Oracle has killed java applet by not handling security issues in a responsible manner.
Java applets died primarily due to the terrible user experience and inconsistent browser support. Security issues were less of a factor.
Re: More Intel speculative execution vulnerabilities
#120Earlier quoted context omitted.
Hewlett-Packard was an electronic engineering, semiconductor, and computing company from the beginning (the first product they sold was an audio distortion analyzer, it used a creative circuit to achieve high performance at minimum cost), they used to do serious and innovative R&D. There were the glorious days when Hewlett-Packard makes state-of-art test equipment and semiconductor devices, developed in-house enterpr…
HP? You mean Agilent-Keysight-HP? :p They’ve split up into companies that are widely successful in each of their individual fields.
The multiple splits and name changes didn't help brand recognition, at least on my end. I remember HP lab equipment being highly impressive and warranting its price. But I consistently fail to make the connection that Agilent amd Keysight products are the successors to that.