Live data from Hacker News

Microsoft disables Spectre mitigations as Intel’s patches cause instability

securityweek.com

231–240 of 329 posts

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#231
post #77
post #39

Earlier quoted context omitted.

I was under the impression that the reason is what u/beagle3 mentions (in a sibling comment to yours): open system files. I'm curious to see your comment on what he describes, as what you mention (reloading some security context) does not seem to be the whole truth. That websites make one log in again after changing your password has nothing to do with this.

That websites make one log in again after changing your password has nothing to do with this. No it is exactly the same principle: something has changed therefore invalidate all existing contexts. Far less error prone than trying to recompute them, what happens e.g. if a resource has already been accessed in a context that is now denied? Security 101.

I don't see how changing my password changes a "security context". I don't suddenly get more or fewer permissions.

As for logging other places out, that's a design choice. People change password either because they routinely change theirs (they either need to or choose to), or because of a (suspected) compromise. In the latter case you'll probably want to log everyone else out (though, who says you're logging out the attacker and not the legitimate user?) and in the former case you shouldn't (otherwise changing your password becomes annoying and avoided). The interface for changing the password could have a "log out all sessions" checkbox or it could just be a feature separate from changing your password.

No, it's not as simple as you put it. No need to condescendingly pass it off as "security 101".

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#232

I'm amazed on how Intel's stock price still keeps going UP, despite all these problems... just WOW.

Spectre affects AMD, too, so there's no competitor to run to... and CERT was saying at one point that only new processors would fully fix it. They're looking at everyone needing to buy a bunch of replacement products, aren't they?

Spectre v2 affects AMD less drastically than it does with Intel, because of the architectural differences between Zen and Intel's processors.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#233
post #32

Earlier quoted context omitted.

Speaking of which, why do so many things require reboot to update on Windows?

There is a very fundamental difference between how Unix and Windows view open files: On Windows, once the file is open, it is that filename that is open; You can't rename or delete it; Therefore, if you want to replace a DLL (or any other file) that is in use, you have to kill any program that uses it before you can do that; And if it's a fundamental library everything uses (USER32.DLL COMCTL.DLL etc), the only effec…

That is incorrect. It just depends on Windows how you call the Win32 API and what parameters you specify. Many options there - in the end it's just an object in the NT kernel space.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#234

Earlier quoted context omitted.

Has AMD processors been confirmed as not vulnerable? As I recall the original investigation only covered Intel processors, but hypothesized that AMD would be affected as well, as they more or less have the same fundamentals around branch prediction.

CPUs from AMD are not vulnerable to Meltdown, but are vulnerable to both versions of Spectre. https://www.amd.com/en/corporate/speculative-execution

Zen is not anywhere quite as vulnerable to Spectre v2 as Intel's CPUs are, due to architectural differences, according to AMD, so that's something.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#235
post #108

Earlier quoted context omitted.

CPUs from AMD are not vulnerable to Meltdown, but are vulnerable to both versions of Spectre. https://www.amd.com/en/corporate/speculative-execution

Damn! So, practically, no modern processor (or consumer laptop, or enterprise server) is safe from Spectre? Time to go off the beaten path.

Arm (starting with Cortex-R7 and higher) and PowerPC are vulnerable to Spectre too.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#237
post #165

>However, Intel does not appear too concerned that the incident will affect its bottom line - the company expects 2018 to be a record year in terms of revenue There is an interesting paradox in our industry. If you pay enough attention (read: money) to security, you will be late to the market, your costs will be high and you lose profit. If you don't pay enough attention, you take the market, get your profits, but yo…

Intel is TBTF. Like the banks but in via different mechanism, they appear to have reached consequence-immunity by becoming critical infrastructure.

Feature of the industry. It would take a new corp entering into the chip industry hundreds of billions and decades to get where Intel is today.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#238
post #224

Earlier quoted context omitted.

I think a general purpose UX should err on the side of "make it difficult for non-technical users to make mistakes" Renaming/Deleting files in use is one of those things that us nerds like to complain about, but it makes sense when you think of an accountant that has an open spreadsheet and accidentally deletes a folder with that file. For average non-technical people (on any OS) I would say it makes sense to block t…

I see you’ve never actually experienced it? It is actually more intuitive for the average user, as the file name is updated across every application immediately. In fact, you can actually change the file name from the top of the window directly.

How does the user know that the file is open? Also, Is it consistent across network folder renames too?

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#239
post #219

Earlier quoted context omitted.

Is there a way to get a nice helpful popup telling me which applications and services to restart?

Yes, there are many ways to determine that on the command line. As far as a GUI, I couldn’t say as that isn’t how I do system administration. I’m not sure what scenario you are envisioning. Usually upgrades are handled via the distribution and its package manager, and the maintainers take care of library issues. It’s not like windows where you go all over downloading packages from websites and installing them over ea…

I was responding to your own comment

>In a case where one could get some sort of inconsistency because of different library versions, you restart the applications.

I am envisioning the same scenario you replied to!

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#240

These updates most definitely could've been handled better. I was having a busy week with exams and I get a call about around 10 machines not booting (this was before the announcement). Sure enough, last thing everyone reported was updating. I call the supplier and apparently they have reports of at least 2000 machines (at that moment) that had to be reimaged across the city (from what I could tell, all were older AM…

Yeah, AWS had scheduled reboots that were supposed to happen around the day this was all announced, so we had to scramble to deal with them manually beforehand so we'd ensure our systems booted up properly.
Post reply on HN