Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft disables Spectre mitigations as Intel’s patches cause instability

securityweek.com

Post reply on HN
Print view View original

41–50 of 329 posts

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#41

Post by mehrdadn »

pjc50 wrote: post #40
thanksgiving wrote: post #29

Earlier quoted context omitted.

Speaking of which, why do so many things require reboot to update on Windows?

Windows executables are opened with mandatory exclusive locking. So you can't overwrite a program or its DLLs while any instances of it are running. If a DLL is widely used, that makes it essentially impossible to update while the system is in use. There is a registry key which allows an update to schedule a set of rename operations on boot to drop in replacement file(s). https://blogs.technet.microsoft.com/brad_rutk…

> Windows executables are opened with mandatory exclusive locking. So you can't overwrite a program or its DLLs while any instances of it are running.

This is not always correct; see: https://news.ycombinator.com/item?id=16256483

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#42

Post by icebraining »

rocqua wrote: post #35
icebraining wrote: post #30

Earlier quoted context omitted.

Nah, it was more than that: The patches do things like add the garbage MSR writes to the kernel entry/exit points. That's insane. That says "we're trying to protect the kernel". We already have retpoline there, with less overhead.

That was about patches to the linux kernel, not the microcode patches.

Yes, but as far as I know Linus has made no comment on the microcode patches, so mm-vorticesoft is probably referring to the Spectre patches in general.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#43

Post by ComodoHacker »

>However, Intel does not appear too concerned that the incident will affect its bottom line - the company expects 2018 to be a record year in terms of revenue

There is an interesting paradox in our industry. If you pay enough attention (read: money) to security, you will be late to the market, your costs will be high and you lose profit. If you don't pay enough attention, you take the market, get your profits, but your product (be it hardware or software) and reputation will be screwed later. And worst of all: there's never enough attention to security.

So by simple logic, an optimal strategy is to forge your product quickly, take your profits within a [relatively] short period and vanish from the market. I guess we'll see this strategy executed from IoT vendors when market start to punish them for their bad sec.

For Intel, that "long period" just happened to be REALLY long.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#45

Post by doktrin »

ComodoHacker wrote: post #43

>However, Intel does not appear too concerned that the incident will affect its bottom line - the company expects 2018 to be a record year in terms of revenue There is an interesting paradox in our industry. If you pay enough attention (read: money) to security, you will be late to the market, your costs will be high and you lose profit. If you don't pay enough attention, you take the market, get your profits, but yo…

You conclusion isn't in agreement with the section you quoted, so are you saying that Intel will be punished by the market in the mid to distant future (after 2018)?

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#46

Post by morsch »

thg wrote: post #27
chrisper wrote: post #2

Just checked for Updates, but there don't seem to be any?

Just in case you, like me, missed the memo where Microsoft said they'd stop supplying security updates if you have no AV / AV incompatible with the patches installed. The fix to the former is creating the registry entry manually. https://support.microsoft.com/en-us/help/4072699/january-3-2...

Bizarre.

Customers without Antivirus

In cases where customers can’t install or run antivirus software, Microsoft recommends manually setting the registry key as described below in order to receive the January 2018 security updates.

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#47

Post by x0x0 »

hishnash wrote: post #21
stinos wrote: post #9

"Here's a patch" - "Here's a patch to disable that other patch" - ... What's next? Repeat? Sounds like this could turn into a maintainance nightmare quickly. Also because I've introduced things like that myself in the past, and that was for normal applications and not a kernel or OS. Somewhere, someday, there's usually this one exception for which none of your rules hold true and the thing blows up in your face. Anyw…

Im really wanding they had more than 6months to do these patches and they did not bother testing on a good number of systems. Its not like MS + Intel dont have enough money to buy a few 1000 testing machines and get some testers on it.

I came here to ask the same thing. How did these folks squander six months?

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#48

Post by Santosh83 »

thg wrote: post #27
chrisper wrote: post #2

Just checked for Updates, but there don't seem to be any?

Just in case you, like me, missed the memo where Microsoft said they'd stop supplying security updates if you have no AV / AV incompatible with the patches installed. The fix to the former is creating the registry entry manually. https://support.microsoft.com/en-us/help/4072699/january-3-2...

Microsoft won't supply updates even if you have no AV installed, including builtin Defender disabled??

I thought stopping updates was only for the case of unpatched AVs that did not set the registry key...

Re: Microsoft disables Spectre mitigations as Intel’s patches cause instability

#50

Post by dotdi »

shultays wrote: post #49

Amount of fuck-up in this whole issue is mind blowing. I am getting more surprised with every new I get

Intel has been called out by Linus Torvalds several days ago for the crappy fixes they delivered for GNU/Linux. I would be very surprised if Intel actually shipped proper fixes for Windows. It's a shame, really.
Post reply on HN