Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel CEO: Patches will come to 90% of chips in the next week

techcrunch.com

Post reply on HN
Print view View original

71–80 of 137 posts

Re: Intel CEO: Patches will come to 90% of chips in the next week

#71

Post by wott »

jokoon wrote: post #25

I wonder what will the next big security hole. I'm becoming very pessimistic about how I can trust computers. Computers can do amazing thing, but software seems fragile, unreliable and untrustworthy. I have been keeping notes on paper for years now, and it doesn't look like it's going to change.

It's been a while I don't bother much about security any more, because I consider everything insecure.

So I just do not put all my eggs in the same basket, I do not store much personal information on my computer, I store even less online, I do not store any money/payment related information, and I just admit I will however sometimes get my butt kicked here or there.

It is like my house. Anyone can break in at any time, and steal my belongings. Do I install an armoured door? Do I build grids on windows? Do I install an alarm with a direct link to a security company? No, no, and no. I just lock my front door. It only protects from a part of opportunity robberies and that's enough for me. I won't take measures to prevent all other possibilities. They can happen at any time, with no difficulty. And so what?

Back to computers. So this very basic mitigation, very limited damage control is enough to make me feel OK. It feels better to admit insecurity as a given, than to constantly fight for a false feeling of security I cannot achieve anyway.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#72

Post by matteotom »

guelo wrote: post #28

What I'm worried about is that it will be hard to avoid these security patches when you don't need them. Say you have a non-virtualized, non-shared server that only runs your own trusted code. I don't want to be forced to pay the performance penalty but it might be unavoidable without resorting to maintaining your own linux fork.

Other commenters have addressed turning off kpti (nokpti boot flag), and Linus has said any additional protections should be toggle-able: https://lwn.net/Articles/743712/

So worst case you compile your own kernel

Re: Intel CEO: Patches will come to 90% of chips in the next week

#73

Post by hodgesrm »

JumpCrisscross wrote: post #16
donaldihunter wrote: post #8

Earlier quoted context omitted.

Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho. EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301

> Very disingenuous of Intel tho This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable. Intel's communication, however, from the first press release to crap like this, has been disingenuous to the poin…

Without taking Intel's side there's another perspective.

Meltdown/Spectre are severe and perhaps even unprecedented security problems but if you put them in the overall security context there are many other issues that outrank them at least from the perspective of non-technical users.

1. A majority of Americans using credit had their private data compromised in the 2017 Equifax breach. [0] That's just one of what are now countless breaches of data. The damage from Meltdown/Spectre is somewhat theoretical at this point whereas the data breaches have led to real fraud against countless individuals and business.

2. Even recent OS versions have large numbers of security bugs--see Greg Kroah-Hartmann's comments on obsolete kernels for specific Linux examples. [1]

3. State actors ranging from the US to North Korea have well-funded operations to steal or corrupt data. If they really want your data they will probably get it even if Meltdown/Spectre had not been discovered.

Finally it's only fair to point out that some of the claims of Intel being disingenuous on the august Hacker News forum [2] turned out to be overblown--other processors are subject to some of the same problems and many users will not notice much difference in the patched systems.

[0] https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac...

[1] http://kroah.com/log/blog/2018/01/06/meltdown-status/

[2] https://news.ycombinator.com/item?id=16064545

Re: Intel CEO: Patches will come to 90% of chips in the next week

#74

Post by sounds »

vardump wrote: post #70
sounds wrote: post #62

Earlier quoted context omitted.

Let me break down what the article really says (it's pretty short): > He also said that Intel expects to issue updates > to its processors soon. More than 90 percent will be > getting them within the week, and the rest by the end > of January. Intel expects 90 percent will "get an update." 90 percent of what? It should be self-evident that Intel means 90 percent in whichever way gives them the largest percentage. I e…

> exposing an MSR to flush the TLB, but only for recent CPUs You write to CR3 register to flush TLB (or use INVPCID to invalidate just a subset of TLB). So not sure what that means, why would you need an MSR for that?

I stand corrected, the MSR is to flush the branch prediction state. Updating my comment above.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#75

Post by guelo »

rayiner wrote: post #69
jacquesm wrote: post #42

Earlier quoted context omitted.

Do you trust all of the userland? Is your machine internet connected? Do you have any open ports? Do you run everything as root? If your answers are yes, no, no, and yes than it likely will make no difference. Otherwise (and the last one is just for fun to attempt to show you this is probably not a wise decision) you probably would do better to take this serious.

How do open ports factor in? And what if you’re internet connected but have JS disabled?

Or an internet connected or proxied web server with normal web server security precautions.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#76

Post by FLUX-YOU »

jokoon wrote: post #25

I wonder what will the next big security hole. I'm becoming very pessimistic about how I can trust computers. Computers can do amazing thing, but software seems fragile, unreliable and untrustworthy. I have been keeping notes on paper for years now, and it doesn't look like it's going to change.

>Computers can do amazing thing, but software seems fragile, unreliable and untrustworthy.

Think about how many successful jobs computers have done for you/us compared to how many breaches/failures actually occur.

We get overwhelmingly more stuff done with computers than without.

Even if I had to attempt to send an email 10 times before it worked, that's much more convenient than walking the actual distance and delivering it myself.

A stack of vulnerability whitepapers looks intimidating, but you're not getting the whole picture.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#77

Post by lawrenceyan »

privong wrote: post #55
welder wrote: post #51

Earlier quoted context omitted.

Just buy an AMD chip right now.

> Just buy an AMD chip right now. AMD chips are reportedly susceptible to Spectre, so that's not going to help. From https://meltdownattack.com : Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, a…

Meltdown, however, is the one that results in nontrivial performance degradation in order to patch.

And Meltdown specifically only affects Intel processors.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#78

Post by [deleted] »

nickysielicki wrote: post #26
glandium wrote: post #20

I thought they already provided a microcode update?

Latest version on downloadcenter.intel.com is 20171117; no microcode update has been published since Spectre/Meltdown have been disclosed. edit: see below, not true; they haven't published it on their own site but have pushed microcode updates to redhat.

[deleted]

Re: Intel CEO: Patches will come to 90% of chips in the next week

#79

Post by loeg »

rdtsc wrote: post #65
shirian wrote: post #41

Earlier quoted context omitted.

For reference, I received this email before today: By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privi... The FreeBSD Security Team was notified of the issue in late December and received a b…

> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not ext…

FreeBSD secteam was only notified — at all — because Netflix (a big FreeBSD user) requested it of Intel. It was a big slap in the face to smaller communities by Intel.

Re: Intel CEO: Patches will come to 90% of chips in the next week

#80

Post by bogomipz »

rdtsc wrote: post #65
shirian wrote: post #41

Earlier quoted context omitted.

For reference, I received this email before today: By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privi... The FreeBSD Security Team was notified of the issue in late December and received a b…

> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not ext…

>"Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me?"

Indeed. There seems to be a security oligarchy now consisting of Google, FB, Apple, Amazon et al. and Intel.

Post reply on HN