461–470 of 639 posts
What are the odds that the NSA already knew about this? Roughly 100%?
Google zero and academia researchers found it independently, following some talk about the concept a while back.
The 3 letters agencies have people of the same calibre working full time on that. They could find it too.
Earlier quoted context omitted.
Why would you do that? If you are concerned for the security of your coins, you should have moved them to a wallet you own that is not hosted on an exchange. The bank you transfer your dollars to is just as likely to get hit by the exact same vurnerability. In addition you have to pay a fee to move your coins, then to wire the dollars to your bank account. Moving from crypto to fiat is also liable to taxation. If the…
The majority of coins on Coinbase are in cold-storage and crypto on Coinbase is insured against this type of breach. I personally wouldn't panic to get my coins out.
It seems that Richard Stallman is not so paranoid after all: > I am careful in how I use the Internet. > I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git ) that fetches them, much like wget, and then mails them back to me…
RMS remains a rambling nutjob and none of this is really applicable to the issue at hand.
We need more people with RMS-type views in Google, Facebook, etc.
Papers describing each attack: https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf From the spectre paper: >As a proof-of-concept, JavaScript code was written that, when run in the Google Chrome browser, allows JavaScript to read private memory from the process in which it runs (cf. Listing 2). Scary stuff.
This is so incredibly bad. Spectre is basically unpatchable . We can do better than we are now with patches but it's all just turd polishing, essentially. A proper fix will require new CPU hardware. And as a kicker? Leaks are basically undetectable.
I don't know for which processors Intel and AMD plan to release microcode updates.
Can someone more knowledgeable than me in regards to this vulnerability tell me: 1. How to best protect my local personal data from being subject to this? 2. Whether I should seriously consider pulling all my cryptocurrency off of any exchanges?
1:
- install security updates for your OS - if it's not ready yet: disable JavaScript in your browser by default and enable it only for resources you trust. otherwise just skip the page. execute third party code with extra caution. any suspicious code should go away (even not inside vm)
2: as long as it's stored in a wallet on your own hardware which you fully control, it should be safe enough
The papers take a while to get to the point. I nearly fell asleep re-reading the same statements until they got to the point: speculative execution of buffer overflows. Could have been said more concisely. Sadly, this seems to be the norm with academic texts.
Earlier quoted context omitted.
You are wrong. Install the NoScript extension and you can see your site without js. NoScript also allows you to selectively enable js per site on a temporary or permanent basis. This is the default way that I and many other people browse the web. https://noscript.net/
Just looking around, general available figures for public internet (as opposed to tor) suggest that anywhere between 0.1% to 1.0% of users have JS disabled. These numbers have also been consistently going down over time. That's a fairly small number to dictate how a system should be designed.
I’m not saying that shouldn’t be done, but business wise its probably usually best to instead add design changes for the latest smartphone screen.
The web isn’t a hypertext graph anymore, it’s a large JavaScript program with a thin html front now.
Azure's response: https://azure.microsoft.com/en-us/blog/securing-azure-custom... This part is interesting considering the performance concerns: "The majority of Azure customers should not see a noticeable performance impact with this update. We’ve worked to optimize the CPU and disk I/O path and are not seeing noticeable performance impact after the fix has been applied. A small set of customers may experience some…
Interesting that they left it this late.
Like the AWS reboots, people will notice. So in the interest of the embargo, both Azure and AWS waited to update as late as they felt was safe. Since we do live migrations and host kernel updates all the time, nobody noticed us :).