121–130 of 137 posts
Earlier quoted context omitted.
FreeBSD secteam was only notified — at all — because Netflix (a big FreeBSD user) requested it of Intel. It was a big slap in the face to smaller communities by Intel.
How did Netflix know about it?
How does one patch a CPU? Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly? Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: https://suppor…
Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho. EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301
Intel is being very disingenuous when they say "contact your OEM/vendor for microcode updates". In consumer reality, vendors mostly won't provide updates, and even if they do, consumers won't install them.
The only practical way to deliver microcode updates to Windows users is through Windows Update, so the real question is when these will make their way to Windows Update.
Earlier quoted context omitted.
Without taking Intel's side there's another perspective. Meltdown/Spectre are severe and perhaps even unprecedented security problems but if you put them in the overall security context there are many other issues that outrank them at least from the perspective of non-technical users. 1. A majority of Americans using credit had their private data compromised in the 2017 Equifax breach. [0] That's just one of what are…
State actors ranging from the US to North Korea No-one really believes that the Norks with their steam-powered computers are hacking anything. Propaganda cuts both ways.
With that in mind, and assuming computer hardware is still being tossed away after such short times of usage (I'd wager PC hardware is used more, but mobile phones are still being tossed like candy paper), I wonder if any IBM clones ever reached North Korean soil. If North Korea speculated on Bitcoins, which they supposedly did (with which computers?), they got some nice income out of that as well. Or would you recon this is all done outside of NK borders e.g. by spies?
Earlier quoted context omitted.
> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not ext…
>>> Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded. AFAIK they all share the same brand name BSD and they are all closely affiliated.
Earlier quoted context omitted.
The more people you tell, the higher the chance of a leak. "Loose lips sink ships."
FreeBSD isn't two people in a garage, it's a foundational part of the internet developed by professionals who can be counted upon to do the right thing. Intel and Google don't have a leg to stand on: I'm super glad they found the bugs, but their disclosure has been nothing but a shitshow.
Earlier quoted context omitted.
Without taking Intel's side there's another perspective. Meltdown/Spectre are severe and perhaps even unprecedented security problems but if you put them in the overall security context there are many other issues that outrank them at least from the perspective of non-technical users. 1. A majority of Americans using credit had their private data compromised in the 2017 Equifax breach. [0] That's just one of what are…
State actors ranging from the US to North Korea No-one really believes that the Norks with their steam-powered computers are hacking anything. Propaganda cuts both ways.
Earlier quoted context omitted.
How do open ports factor in? And what if you’re internet connected but have JS disabled?
Open ports mean there is a service listening. A service listening means that there is code on your box interfacing with the internet. That means there is the possibility that an exploit in that code could lead to remote code execution. The meltdown vulnerability means that any remote code execution vulnerability can be escalated to the highest levels. Exploiting meltdown means you can read all of kernel memory, that…
Earlier quoted context omitted.
State actors ranging from the US to North Korea No-one really believes that the Norks with their steam-powered computers are hacking anything. Propaganda cuts both ways.
You don't believe North Korea can procure modern computers?
What I'm worried about is that it will be hard to avoid these security patches when you don't need them. Say you have a non-virtualized, non-shared server that only runs your own trusted code. I don't want to be forced to pay the performance penalty but it might be unavoidable without resorting to maintaining your own linux fork.
Earlier quoted context omitted.
Let me break down what the article really says (it's pretty short): > He also said that Intel expects to issue updates > to its processors soon. More than 90 percent will be > getting them within the week, and the rest by the end > of January. Intel expects 90 percent will "get an update." 90 percent of what? It should be self-evident that Intel means 90 percent in whichever way gives them the largest percentage. I e…
...or maybe the other 10% are in-order non-speculative designs which are intrinsically immune; they still have a few: https://en.wikipedia.org/wiki/Intel_Quark (basically a die-shrink of a 486!) https://en.wikipedia.org/wiki/Bonnell_(microarchitecture)
"Intel Quark SoC X1000 contains a bug #71538[11] that "under specific circumstances" results in crash, known in the industry as a segfault. The workaround implemented by Intel is to omit LOCK instructions in the compiled code.[12] While Yocto Project based embedded systems incorporate this workaround, general purpose Linux distributions such as Debian are deeply affected by the bug. Such a workaround is not easy to implement on multithreading systems as they require LOCK instruction to function properly."