Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft disables Spectre mitigations as Intel’s patches cause instability

securityweek.com

Post reply on HN
Print view View original

251–260 of 329 posts

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#251

Post by nomel »

rubatuga wrote: post #227
ksk wrote: post #224

Earlier quoted context omitted.

I think a general purpose UX should err on the side of "make it difficult for non-technical users to make mistakes" Renaming/Deleting files in use is one of those things that us nerds like to complain about, but it makes sense when you think of an accountant that has an open spreadsheet and accidentally deletes a folder with that file. For average non-technical people (on any OS) I would say it makes sense to block t…

I see you’ve never actually experienced it? It is actually more intuitive for the average user, as the file name is updated across every application immediately. In fact, you can actually change the file name from the top of the window directly.

I have experienced this many times in MacOS after deleting a file/folder and replacing it with some other version, like one downloaded from an email. After a while, I realize that I'm working from ~/.Trash and the attachment I just sent didn't include the changes I had been making for the last hour.

I've had this happen in bash also, where I modify some script in an external editor then try to run it, only to realize that I'm running from the trash, even though the bash prompt naively tells me I'm in ~/SomethingNotTrashFolder.

Intuitive would be "Hey, this file you're working on was just moved to the trash. There's a 99.9999% chance you don't want to do this." rather than hoping the filepath is visible, and noticed by dumb chance, in the title bar, since not many people periodically glance at the file they have open to verify it's still the file they want open.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#252

Post by jerf »

Mister_Snuggles wrote: post #248
jerf wrote: post #242

Earlier quoted context omitted.

"But yeah, upstream Linux kernel development is taking it slow." Taking it slow seems very appropriate to me. This seems to me to have been a case of everybody grossly overestimating the short-term portion of the catastrophe, and underestimating the long term. In the short term, the only people who were going to be plausibly affected in the next three to six months are people on shared hosting of some sort where you…

I read somewhere that people have developed POCs of these using JavaScript. At minimum, you'll want to keep your browser up to date as there are mitigations happening there too. Who knew that exposing high precision timers to untrusted JavaScript would be a bad idea? Apart from browsers, it's fortunately pretty easy to avoid running code you don't trust on your devices.

What I've seen that the POCs can actually do is not worth running around with your hair on fire, from what I've seen.

Note I did not say there is no reason to be concerned about Meltdown and Spectre... just that for most users, uses, and systems, it's not that important. In the next three-to-six months, if you care about security at all, unless you are already running a tip-top tight operation, your money and effort is better spent defending against the many already-realistic threats, rather than worrying about the vector that may someday be converted into a realistic threat. Meltdown isn't what is going to drag your business to a halt next week; it's that ransomware that one of your less-savvy employees opened while mapped to the unbacked-up world-writable corporate share that has all the spreadsheets your business runs on. At the moment, the net risk of applying the Meltdown fix comfortably exceeds by several orders of magnitude the risk that Meltdown itself poses.

And my point is precisely that for most users and uses, that panic was not justified. Those for whom that is not true (VM hosting companies) already know they need to be more aggressive. There was no point in pushing out patches that nearly bricked some computers.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#253

Post by javajosh »

AnIdiotOnTheNet wrote: post #162
ComodoHacker wrote: post #43

>However, Intel does not appear too concerned that the incident will affect its bottom line - the company expects 2018 to be a record year in terms of revenue There is an interesting paradox in our industry. If you pay enough attention (read: money) to security, you will be late to the market, your costs will be high and you lose profit. If you don't pay enough attention, you take the market, get your profits, but yo…

I doubt Intel will see serious punishment in the market. As usual, there will be a lot of wailing and gnashing of teeth but when push comes to shove most people will prioritize nearly everything over security. All markets work like this. People bitch about the quality of products, but still buy the cheap stuff.

This will be true until something uses Meltdown in the wild to cause massive damage. When a digital superflu comes, businesses and individuals will be faced with a choice: continue to use Intel and be vulnerable to a flu that is literally wiping out businesses, exchanges, hospitals, etc or replace ALL of their hardware with AMD.

Interestingly, I think AMD has a lot of motive to create such a superflu, or at least encourage it's creation.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#255

Post by curun1r »

_jal wrote: post #165
ComodoHacker wrote: post #43

>However, Intel does not appear too concerned that the incident will affect its bottom line - the company expects 2018 to be a record year in terms of revenue There is an interesting paradox in our industry. If you pay enough attention (read: money) to security, you will be late to the market, your costs will be high and you lose profit. If you don't pay enough attention, you take the market, get your profits, but yo…

Intel is TBTF. Like the banks but in via different mechanism, they appear to have reached consequence-immunity by becoming critical infrastructure.

The same could've been said about Microsoft 10-15 years ago. Now, we could probably get by without them.

Intel may be too big for an abrupt failure, but they can absolutely fail in a decade-long slide into obscurity.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#256

Post by saym »

noiv wrote: post #249
InvisibleCities wrote: post #215

Earlier quoted context omitted.

Trust me, if you don't like the idea of your entire livelihood hinging on weather or not a piece of equipment boots up, farming is NOT the career for you.

I like the idea of Internet Weather. Seems probability of rain is currently increasing. And so does anticipation of floods and surges.

Do you think there's a market for "Cloud Meteorologists"?

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#257

Post by xfer »

mehrdadn wrote: post #139
beagle3 wrote: post #122

Earlier quoted context omitted.

I have been running Ubuntu since 2004, and except for Firefox which tends to destabilize on update, I’ve observed this twice in 14 years; I update weekly or more often, and reboot every few months (usually on a kernel update I want to take hold)

Maybe it's because you update often so there are fewer changes in between? I update far less frequently.. it's not my primary OS so it's not like I'm even on it every day (or week). I use it whenever I need to.

Have you filed any bug report or point to one? All i have seen is a lot of handwaving about "IPC mismatch", things will not fix itself unless people actively report/help fix issues.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#259

Post by stickfigure »

c3534l wrote: post #230
zingmars wrote: post #168

These updates most definitely could've been handled better. I was having a busy week with exams and I get a call about around 10 machines not booting (this was before the announcement). Sure enough, last thing everyone reported was updating. I call the supplier and apparently they have reports of at least 2000 machines (at that moment) that had to be reimaged across the city (from what I could tell, all were older AM…

Farming is all mechanized these days. Farmers have to deal with OS and firmware updates on their tractors.

...and DRM: https://motherboard.vice.com/en_us/article/xykkkd/why-americ...

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#260

Post by dang »

speedie wrote: post #174
tjoff wrote: post #18

I lost many hours over this last week. The system was unable to boot and finally a thread on reddit came to the rescue ( https://www.reddit.com/r/techsupport/comments/7sbihd/howto_f... ). This actually made the system boot but there are some leftovers being installed on first boot that I've been unable to disable that also causes the system to be unable to boot. So now, the machine is running but as soon as it is res…

If if weren't such a bih issue , this would be actually funny . M$ funboys bashing linux over an Intel patch that's rendering winblows useless ? ffs ...

Would you please stop posting unsubstantive comments to Hacker News? You're welcome here if you want to use the site as intended, but comments need to be better than this. If you'd read https://news.ycombinator.com/newsguidelines.html and https://news.ycombinator.com/newswelcome.html and take that spirit to heart, we'd appreciate it.
Post reply on HN