Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel CEO: Patches will come to 90% of chips in the next week

techcrunch.com

Post reply on HN
Print view View original

101–110 of 137 posts

Re: Intel CEO: Patches will come to 90% of chips in the next week

#101

Post by user5994461 »

rdtsc wrote: post #65
shirian wrote: post #41

Earlier quoted context omitted.

For reference, I received this email before today: By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privi... The FreeBSD Security Team was notified of the issue in late December and received a b…

> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not ext…

>>> Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded.

AFAIK they all share the same brand name BSD and they are all closely affiliated.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#102

Post by flukus »

cratermoon wrote: post #85
jayflux wrote: post #57

Earlier quoted context omitted.

Is that really good PR? Or just news that hasn't hit the mainstream because they don't understand it or doesn't affect them much.

It's good PR. If a mainstream media outlet looks into it they are predisposed to "hear" two views and weigh them equally. They'll get one from the OS/Security community saying "this is really bad" and one from Intel (via their spokespeople) saying "don't worry about it, we got it". Then their journalistic tendency will be to give more weight to what Intel say over what a bunch of "nerds" say, and the resulting headli…

I thinks it's more a case of bad "marketing" from project zero. Had the stuck with a single name "spectre" (with 3 variants) then the media would have had a story that's much easier to understand and repeat/sell. When it's a case of "x affects a" and "y affects a, b and c" then the story gets to confusing for them and their readers.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#103

Post by Dylan16807 »

bcantrill wrote: post #27

This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any OS that isn't Windows, MacOS or mainline Linux), that work is ongoing and will depend on the OS. (Speaking for SmartOS/illumos, that work is reasonably far along and making promising progress -- but we don't yet have a functional prototype.) As for Spectre, thes…

> This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS.

Why is that? In theory, on a generic CPU, the microcode changes to stop Meltdown are drastically simpler than the mitigations for Spectre. Are Intel chips incapable of implementing them?

Re: Intel CEO: Patches will come to 90% of chips in the next week

#105

Post by tannhaeuser »

8_hours_ago wrote: post #84
bcantrill wrote: post #27

This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any OS that isn't Windows, MacOS or mainline Linux), that work is ongoing and will depend on the OS. (Speaking for SmartOS/illumos, that work is reasonably far along and making promising progress -- but we don't yet have a functional prototype.) As for Spectre, thes…

FYI, Ubuntu released updates today for Meltdown: Ubuntu 16.04 LTS: https://usn.ubuntu.com/usn/usn-3522-1/ Ubuntu 14.04 LTS: https://usn.ubuntu.com/usn/usn-3522-2/ Ubuntu 17.10: https://usn.ubuntu.com/usn/usn-3523-1/

Would you know if the patches are or will be included in the mainline kernels which are at 4.4.14 and 4.4.15?

Re: Intel CEO: Patches will come to 90% of chips in the next week

#106

Post by InclinedPlane »

rayiner wrote: post #69
jacquesm wrote: post #42

Earlier quoted context omitted.

Do you trust all of the userland? Is your machine internet connected? Do you have any open ports? Do you run everything as root? If your answers are yes, no, no, and yes than it likely will make no difference. Otherwise (and the last one is just for fun to attempt to show you this is probably not a wise decision) you probably would do better to take this serious.

How do open ports factor in? And what if you’re internet connected but have JS disabled?

Open ports mean there is a service listening. A service listening means that there is code on your box interfacing with the internet. That means there is the possibility that an exploit in that code could lead to remote code execution. The meltdown vulnerability means that any remote code execution vulnerability can be escalated to the highest levels.

Exploiting meltdown means you can read all of kernel memory, that destroys any additional layers of protection you might fantasize you had. It means that in memory passwords and encryption keys can be copied. It means that IO between other processes can be spied on. It means that all of the juicy locations to exploit for "return oriented programming" in order to gain local root will be laid bare. And so on.

That's why it's called meltdown. Imagine someone who had hand crafted the equivalent of a modern OS with all of the best practices in place for an internet server. You have kernel address randomization. You have each service running as its own non-privileged user and also in a chroot jail. You have your filesystem permissions locked down tight. And so on. All of that is gone out the window with meltdown, it doesn't matter, because even code running at the lowest possible privilege level can gain access to the contents of any part of kernel memory.

As for "workstation" systems. If you are behind a firewall, you never run untrusted code, and you have JS disabled then potentially you are safe.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#107

Post by beefhash »

user5994461 wrote: post #99
kchoudhu wrote: post #93

Earlier quoted context omitted.

FreeBSD isn't two people in a garage, it's a foundational part of the internet developed by professionals who can be counted upon to do the right thing. Intel and Google don't have a leg to stand on: I'm super glad they found the bugs, but their disclosure has been nothing but a shitshow.

They can't be counted on anything after they publicly announced they would ignore embargo.

That was OpenBSD, not FreeBSD.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#108

Post by [deleted] »

user5994461 wrote: post #99
kchoudhu wrote: post #93

Earlier quoted context omitted.

FreeBSD isn't two people in a garage, it's a foundational part of the internet developed by professionals who can be counted upon to do the right thing. Intel and Google don't have a leg to stand on: I'm super glad they found the bugs, but their disclosure has been nothing but a shitshow.

They can't be counted on anything after they publicly announced they would ignore embargo.

[deleted]

Re: Intel CEO: Patches will come to 90% of chips in the next week

#109

Post by paulmd »

maltalex wrote: post #4

How does one patch a CPU? Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly? Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: https://suppor…

> How does one patch a CPU?

Microcode updates that enable or disable various feature flags or patch the microcode used to interpret specific instructions from the outside CISC world to the native RISC world that all modern x86 processors use.

In terms of deployment, there is support for OSs to deploy microcode from Ring 0 each time the system boots, or the permanent fix is a new UEFI that includes the new microcode at system init.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#110

Post by loeg »

user5994461 wrote: post #101
rdtsc wrote: post #65

Earlier quoted context omitted.

> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not ext…

>>> Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded. AFAIK they all share the same brand name BSD and they are all closely affiliated.

> AFAIK they all share the same brand name BSD and they are all closely affiliated.

This is a gross falsehood.

They all variously diverged from a parent project, called BSD, in the 90s. Since then they are wholly independent. Because of the common license and heritage, code sharing is often easy and legally unrestricted. But their leaders, policies, and philosophies are very distinct.

Post reply on HN