4 ms·

I edited my reply to remove the actual number. The argument still stands that you cannot expect 100% reliability.

by avian 9y ago

monochromatic 9y ago
A small probability of random errors can be lived with. Errors that can be triggered and exploited are unacceptable.
blattimwind 9y ago
Generally speaking, a piece of JavaScript in some 0x0 pixel iframe in a tab you're not even looking at can't summon cosmic particles to manipulate your computer's main memory. Rowhammer can.
brians 9y ago
No, but it’s straightforward engineering to prevent many of these problems. Error-correcting codes have been well understood for most of a century. Yes, it costs in performance and in money. For life-safety applications, it shouldn’t be optional. Amazon is hosting life-safety applications in EC2. Commodity x86 hardware is grossly negligent for that environment.
- jchw 9y ago
  ECC as it is today may not be sufficient. It's mostly useful against single bit flips. Probably better than nothing, though...
  - deleted 9y ago
    [deleted]
  - brians 9y ago
    ECC alone is absolutely insufficient. But ECC can be part of a system design that includes active monitoring and response. I’d expect that system design to also include measurement of ECC events under ordinary conditions, regular re-measurement, and funding for an analysis of the changes and explanation of the difference—just like you’d find in safety engineering in a coal plant, an MRI machine, any sort of engineering that has a professional scientist or engineer on site supervising all operations. Of course, you’ll also find a tendency there towards specified hardware. They bend or break it to use COTS x86 machines, but—as I think I heard from a comment here last week—nearly nobody ever specified wanting AMT in the initial design, so it’s pretty weird that we’re all buying and deploying it.

4 ms·

I edited my reply to remove the actual number. The argument still stands that you cannot expect 100% reliability.

by avian 9y ago

I edited my reply to remove the actual number. The argument still stands that you cannot expect 100% reliability.

monochromatic 9y ago
A small probability of random errors can be lived with. Errors that can be triggered and exploited are unacceptable.
blattimwind 9y ago
Generally speaking, a piece of JavaScript in some 0x0 pixel iframe in a tab you're not even looking at can't summon cosmic particles to manipulate your computer's main memory. Rowhammer can.
brians 9y ago
No, but it’s straightforward engineering to prevent many of these problems. Error-correcting codes have been well understood for most of a century. Yes, it costs in performance and in money. For life-safety applications, it shouldn’t be optional. Amazon is hosting life-safety applications in EC2. Commodity x86 hardware is grossly negligent for that environment.
- jchw 9y ago
  ECC as it is today may not be sufficient. It's mostly useful against single bit flips. Probably better than nothing, though...
  - deleted 9y ago
    [deleted]
  - brians 9y ago
    ECC alone is absolutely insufficient. But ECC can be part of a system design that includes active monitoring and response. I’d expect that system design to also include measurement of ECC events under ordinary conditions, regular re-measurement, and funding for an analysis of the changes and explanation of the difference—just like you’d find in safety engineering in a coal plant, an MRI machine, any sort of engineering that has a professional scientist or engineer on site supervising all operations. Of course, you’ll also find a tendency there towards specified hardware. They bend or break it to use COTS x86 machines, but—as I think I heard from a comment here last week—nearly nobody ever specified wanting AMT in the initial design, so it’s pretty weird that we’re all buying and deploying it.