15 ms·

This is probably one of the poorest and most defensive PR pieces I've read from a company in a long time, and it does not really make me sympathetic to them at

This is probably one of the poorest and most defensive PR pieces I've read from a company in a long time, and it does not really make me sympathetic to them at all. > Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data. This is deceptive. It very quickly acknowledge the confidentiality aspect, but then claims that is "operating as designed" and then immediacy try to damage control by pointing out what the exploits cannot do (corrupt/modify/delete). > Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits. This is deceptive. In the first sentence it combines two statements: 1) bug/flaw in Intel products and 2) that it is unique to Intel. In the rest of the paragraph it then claims that the previous statements are incorrect, but only addressing the second point. > Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time. This is deceptive. It immediately mentions AMD to give the impression that AMD also suffer from the problem. It then goes on with a straw man about performance impacts ("contrary to some reports"). And then mentions "average computer user" whereas the real problem is obviously not average computer users. Again, deceptive.

Nition 9y ago
Yeah, I had to read the “bug” or “flaw” part twice to be sure they're not saying it isn't a bug or flaw, they're only saying it isn't unique to Intel. And then as you say, they immediately mention AMD to imply that everyone has the issue, but they also avoid actually saying that. Your excellent analysis of what they're really saying reminds me of user thaumaturgy's analysis of Adancing Our Amazing Bet[1]. [1] https://news.ycombinator.com/item?id=12793033 https://news.ycombinator.com/item?id=12793033
- martin1975 9y ago
  Bet you a dollar some lawyer had to vet that three times over before they published it.
  - x0x0 9y ago
    My suspicion is they don't get sued; rather, Werner Vogels calls Intel and tells them the massive haircut / refund they're gonna take. Or Werner buys amd procs.
  - monocasa 9y ago
    With the obvious class action suit that's coming, I don't know what else better their counsel has to do on a Monday night.
  - Strudelnoggin 9y ago
    That same lawyer no doubt had to tell them that the following statement wouldn't fly without the addition of the word "believes": "Intel believes its products are the most secure in the world [ . . . ]"
    - martin1975 9y ago
      Nicely done. Words like 'is' incur liability because it can be interpreted as making factual statements that you could be held accountable for. Hurry, get your law degree so you can skin Intel alive ;)
  - foobarian 9y ago
    Bet you another dollar it was more than one lawyer.
- simooooo 9y ago
  They said it wasn't the paragraph before
- ksec 9y ago
  They could have just said other Industry vendors, but they HAD to name names. To add insult to this already cheap shot, it was flat out lies and AMD isn't vulnerable to all three variants. This is just pathetic.
frik 9y ago
Intel should now recall the affected CPUs and ship new fixed CPUs without Intel "ME" for Management Engine, another well known open flaw. In the end, hardware and software devs in the 1970s were right. Operating systems like MULTICS and computers like PDP-11 got it right. MULTICS supported 16 rings and has many advanced features that almost everyone forgot and never implemented in newer OS - shame on all of us! Intel CPUs barely support more than 2.5 rings (if you count the VT that just blowed up). Also operating systems need to now focus on supporting more rings too. Just 2 rings aka kernel and usermode (and VT supervisor as third) is NOT enough in 2018.
- frou_dh 9y ago
  > Intel should now recall the affected CPUs and ship new fixed CPUs You think they have the tooling to manufacture drop-in replacements for up to decade old CPUs, even if they wanted to?
  - frik 9y ago
    Wtf? Have I said that? No.
samstave 9y ago
Uh... they don’t say the exploits don’t allow for READING of data... That’s the most concerning thing then
- PuffinBlue 9y ago
  That's really the key. "No problem here, move along, move along - you won't be able to modify/corrupt/delete that password, you can only read it in plain text. Nothing to see. Move on." IIUC - you can transpose 'password' with seemingly anything stored in memory managed by the kernel, so Intel using this sort of deceptive language is poor behaviour.
  - IncRnd 9y ago
    > IIUC - you can transpose 'password' with seemingly anything stored in memory managed by the kernel, so Intel using this sort of deceptive language is poor behaviour. Intel wasn't being deceptive. That is exactly what they said, "software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data." This is in the very first sentence of their response.
    - tomxor 9y ago
      They also stated it does not have the potential to cause deletion, modification or corruption which directly contradicts the "malicious purposes" statement.
      - IncRnd 9y ago
        > They also stated it does not have the potential to cause deletion, modification or corruption which directly contradicts the "malicious purposes" statement. You are mixing two different notions. In security CIA = Confidentiality, Integrity, Availability. Intel said that Confidentiality is broken by a security analysis applied maliciously (i.e. exploit), but Integrity is not. The general belief is that Availability is affected, due to a slowdown that depends on the workload.
monfera 9y ago
In the case of asymmetric competition, a company with vastly more resources might curate a list of undisclosed problems with competitors' products, for when a major event like this strikes, they can drag along the underdogs. The optics are different if 1) the dominant player can pretend it's "working together" with the other vendors, 2) the dominant player condescendingly points out mildly related issues in competitors' product, and 3) the name of the alternatives keeps getting linked in a "we're in the same boat" way. I'm not suggesting this is the case here at all, as it's unlikely that Intel identified this precise issue with AMD long ago and haven't checked their own vulnerability (though there's always a chance that an issue is found by company A when analyzing the strengths and weaknesses of company B's products, which then turns out to apply for their own products too). But I wouldn't be surprised if somehow there were some loosely related AMD issues that came to light now, and it's impossible to tell if those would be current finds or older ones. Given Intel's dominant position, they may come out ahead in P&L or gross margin terms even if it turns out to be a clearly Intel issue, as the perceived or real loss of performance may trigger an upgrade spree, sold unit counts inevitably dominated by Intel purchases. AMD has just started to catch up in overall performance, and in the worst case bug impact to Intel, they may even get competitive single-threaded performance. Also, there has been speculation that Apple has been evaluating ARM processors for some future laptops, and a sudden drop of the baseline is an interesting turn of events. While this in theory benefits the underdogs, financially Intel may well come out ahead due to their market hegemony.
haberman 9y ago
I could be wrong, but I take the "bug/flaw" language to mean this: the processor is doing exactly what it was designed to do (unlike the Pentium FDIV bug, for example). A new class of exploit was recently discovered, and these CPUs are vulnerable to this new exploit. But there was no bug in how these CPUs were implemented, and the only design flaw is that they failed to withstand a new class of exploit that was not known at the time they were designed. (I don't have any information that could confirm/deny this, it's just how I interpret their verbiage). I don't get the sense that they are trying to deceptively contradict only part of the previous statement.
- foxylad 9y ago
  My limited understanding is that the vulnerability is due to kernel memory protections not being applied during speculative execution, when the CPU is trying to second guess what the next instructions might be. Unless you are in PR, any reasonable person would expect a CPU touted as having kernel memory protection to protect it under all circumstances. I'm sure that the people who wrote the speculative execution code would have included that protection had they thought of it, and all developers would class it's omission as a bug. So yes, this is yet another example of awful PR, trying to cover up a serious mistake with careful language that makes it seem not their fault. My policy when I make a mistake is immediate disclosure, along with two commitments: to put the mistake right, and to amend processes to prevent similar mistakes in the future. It isn't clear how Intel can put this right, but perhaps a good discount on replacement parts might help. And they can certainly implement processes to catch such omissions in the future. So this press release (particularly combined with reports of execs selling stock) are appalling. Intel have badly damaged their brand, and I'll never buy another Intel processor again.
- redcalx 9y ago
  It's kind of semantics though isn't it? If I write a piece of software that follows the spec and fulfils the customer's need, but then someone tries to do something with it that we hadn't thought of and that results in a security hole... around here we call that a bug, a flaw, something we missed. Maybe it's reasonable to have not spotted the bug, but that wouldn't make it not a bug/flaw.
Danihan 9y ago
> Intel believes these exploits do not have the potential to corrupt, modify or delete data. Unless you view a key or password... then use it to corrupt, modify or delete data.
- path411 9y ago
  Bugs don't cause security leaks, it's the hackers that do! Software security is really just a social problem.
droopybuns 9y ago
I feel like a lot of really smart people are really naive about public relations. PR exists to protect the company from the masses and the lawyers. We in the tech community should not waste time personalizing a response to pr communications. We are not the target market. It is the general public and politicians they are trying to persuade. If they ameliorate them, they win and can move on to the next fight. They will play word games and fiddle with language. It is not worth responding to PR if you deeply understand the problem. You will only find problematic statements. You will never get satisfaction because satisfying the technical community is a fundamental error for anyone who knows what they are doing in public relations. There are other venues for us. Patch notes and tech forums are worthy of your time.
deleted 9y ago
[deleted]
ec109685 9y ago
> They said they verified Spectre attacks on AMD and ARM processors, as well. https://www.wired.com/story/critical-intel-flaw-breaks-basic-security-for-most-computers/ https://www.wired.com/story/critical-intel-flaw-breaks-basic...
noncoml 9y ago
> This is deceptive. It immediately mentions AMD to give the impression that AMD also suffer from the problem. It looks like (some?) AMD processors might be affected as well: "These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running them."[1] [1] https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...
- arghwhat 9y ago
  From what I can gather, one of the 3 issues found is Intel-only, very bad and very easy to exploit, and can be patched with a large performance hit. Another is harder to exploit, and has no known workaround (likely requiring new silicon to fix), and affects basically all micro-architectures in use today, including AMD's x86 silicon. The third, I know nothing of.
  - BuildTheRobots 9y ago
    Ah, it must be serious, there's now a branded website [1] for it ;) I believe the Intel only issue is called "Meltdown" and the second is called "Spectre"; the attack website [1] has details of both. [1] https://meltdownattack.com/ https://meltdownattack.com/
    - smaddox 9y ago
      Reading the Meltdown paper [1], it's not clear why I keep seeing people say it's Intel only. The paper says quite clearly that other vendors' processors could be affected: "Instead, Meltdown exploits side-channel information available on most modern processors, e.g., modern Intel microarchitectures since 2010 and potentially on other CPUs of other vendors." [1] https://meltdownattack.com/meltdown.pdf https://meltdownattack.com/meltdown.pdf
      - pksadiq 9y ago
        > "Instead, Meltdown exploits side-channel information available on most modern processors, e.g., modern Intel microarchitectures since 2010 and potentially on other CPUs of other vendors." But their website faq says[0]: every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). .... Currently, we have only verified Meltdown on Intel processors.... [0] https://meltdownattack.com/#faq-systems-meltdown https://meltdownattack.com/#faq-systems-meltdown
tomxor 9y ago
>...pointing out what the exploits cannot do (corrupt/modify/delete). That statement is also untrue if you follow the implicit issue to it's inevitable exploitable end... Here is an equivalent statement of equal absurdity that intentionally neglects causality: "Our door lock design contains a bug. The bug does not make stuff in your house disappear, does not manifest junkies into the vicinity, nor does it make property spontaneously combust."
endorphone 9y ago
I am going to go on a limb and speculate that Intel probably knows more about this problem than most. They are being quite specific that the issue affects multiple devices, and I doubt they are lying. And coincidentally several other reports (from Google, Wired and others) are indicating that this issue crosses CPU makers. In that context, isn't you reply rather off the mark? If Intel's claim is correct, then being "defensive" seems entirely accurate given how many are foaming at the mouth at the prospect of some mortally wounded Intel.
gshulegaard 9y ago
> This is deceptive. In the first sentence it combines two statements: 1) bug/flaw in Intel products and 2) that it is unique to Intel. In the rest of the paragraph it then claims that the previous statements are incorrect, but only addressing the second point. This is excellent analysis. I guess my follow up question is has there been anything to suggest that AMD/ARM are or are not vulnerable in a similar manner? I read this as Intel trying to imply that other vendors weren't probed and/or may not have this specific design vulnerability but can still be vulnerable...which I consider a vapid statement designed to distract the reader. True, when a 0-day is found and disclosed it doesn't mean that there aren't other 0-days that haven't been found yet...but that has no relation to the significance of the newly disclosed vulnerability. I judge this statement even more harshly because the flaw is so serious it's under embargo until OS vendors can try to protect users. Additionally, AMD seems to have said their processors are not vulnerable (https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2)... Edit: Some more information from Google Project Zero: https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi... So maybe AMD and ARM are vulnerable? Edit 2: So it seems there are two slightly different attacks along this vector: Spectre and Meltdown. From the Google article(s) it seems Spectre affects Intel, AMD, ARM while Meltdown only affects Meltdown. This would appear to contradict the AMD statement regarding their processors not being affected. I am not hardware guy and information is still coming out...but I am judging this Intel press release slightly less harshly (although it still reads pretty vapid).
- strmpnk 9y ago
  The patch that was under question was related to a workaround for Meltdown, which makes AMD's note regarding the lack of necessity in agreement with the paper. The Spectre paper seems to be a bit less specific on how platforms might differ under explotation but very clearly states that it was verified to be possible. Workarounds for that problem will likely be much more application specific from what I can tell, but I have only skimmed that paper so far.
  - strmpnk 9y ago
    Update: AMD has an official statement with a clear outline of the discussed vulnerabilities: https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution
fpoling 9y ago
Formally it is a bug in the spec, so indeed Intel products performs as designed. What is deceptive in the first part that the text does not tell that the design and specs were also done by Intel.

Nition 9y ago

Yeah, I had to read the “bug” or “flaw” part twice to be sure they're not saying it isn't a bug or flaw, they're only saying it isn't unique to Intel. And then as you say, they immediately mention AMD to imply that everyone has the issue, but they also avoid actually saying that. Your excellent analysis of what they're really saying reminds me of user thaumaturgy's analysis of Adancing Our Amazing Bet[1]. [1] https://news.ycombinator.com/item?id=12793033 https://news.ycombinator.com/item?id=12793033

martin1975 9y ago
Bet you a dollar some lawyer had to vet that three times over before they published it.
- x0x0 9y ago
  My suspicion is they don't get sued; rather, Werner Vogels calls Intel and tells them the massive haircut / refund they're gonna take. Or Werner buys amd procs.
- monocasa 9y ago
  With the obvious class action suit that's coming, I don't know what else better their counsel has to do on a Monday night.
- Strudelnoggin 9y ago
  That same lawyer no doubt had to tell them that the following statement wouldn't fly without the addition of the word "believes": "Intel believes its products are the most secure in the world [ . . . ]"
  - martin1975 9y ago
    Nicely done. Words like 'is' incur liability because it can be interpreted as making factual statements that you could be held accountable for. Hurry, get your law degree so you can skin Intel alive ;)
- foobarian 9y ago
  Bet you another dollar it was more than one lawyer.
simooooo 9y ago
They said it wasn't the paragraph before
ksec 9y ago
They could have just said other Industry vendors, but they HAD to name names. To add insult to this already cheap shot, it was flat out lies and AMD isn't vulnerable to all three variants. This is just pathetic.

frik 9y ago

Intel should now recall the affected CPUs and ship new fixed CPUs without Intel "ME" for Management Engine, another well known open flaw. In the end, hardware and software devs in the 1970s were right. Operating systems like MULTICS and computers like PDP-11 got it right. MULTICS supported 16 rings and has many advanced features that almost everyone forgot and never implemented in newer OS - shame on all of us! Intel CPUs barely support more than 2.5 rings (if you count the VT that just blowed up). Also operating systems need to now focus on supporting more rings too. Just 2 rings aka kernel and usermode (and VT supervisor as third) is NOT enough in 2018.

frou_dh 9y ago
> Intel should now recall the affected CPUs and ship new fixed CPUs You think they have the tooling to manufacture drop-in replacements for up to decade old CPUs, even if they wanted to?
- frik 9y ago
  Wtf? Have I said that? No.

samstave 9y ago

Uh... they don’t say the exploits don’t allow for READING of data... That’s the most concerning thing then

PuffinBlue 9y ago
That's really the key. "No problem here, move along, move along - you won't be able to modify/corrupt/delete that password, you can only read it in plain text. Nothing to see. Move on." IIUC - you can transpose 'password' with seemingly anything stored in memory managed by the kernel, so Intel using this sort of deceptive language is poor behaviour.
- IncRnd 9y ago
  > IIUC - you can transpose 'password' with seemingly anything stored in memory managed by the kernel, so Intel using this sort of deceptive language is poor behaviour. Intel wasn't being deceptive. That is exactly what they said, "software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data." This is in the very first sentence of their response.
  - tomxor 9y ago
    They also stated it does not have the potential to cause deletion, modification or corruption which directly contradicts the "malicious purposes" statement.
    - IncRnd 9y ago
      > They also stated it does not have the potential to cause deletion, modification or corruption which directly contradicts the "malicious purposes" statement. You are mixing two different notions. In security CIA = Confidentiality, Integrity, Availability. Intel said that Confidentiality is broken by a security analysis applied maliciously (i.e. exploit), but Integrity is not. The general belief is that Availability is affected, due to a slowdown that depends on the workload.

monfera 9y ago

In the case of asymmetric competition, a company with vastly more resources might curate a list of undisclosed problems with competitors' products, for when a major event like this strikes, they can drag along the underdogs. The optics are different if 1) the dominant player can pretend it's "working together" with the other vendors, 2) the dominant player condescendingly points out mildly related issues in competitors' product, and 3) the name of the alternatives keeps getting linked in a "we're in the same boat" way. I'm not suggesting this is the case here at all, as it's unlikely that Intel identified this precise issue with AMD long ago and haven't checked their own vulnerability (though there's always a chance that an issue is found by company A when analyzing the strengths and weaknesses of company B's products, which then turns out to apply for their own products too). But I wouldn't be surprised if somehow there were some loosely related AMD issues that came to light now, and it's impossible to tell if those would be current finds or older ones. Given Intel's dominant position, they may come out ahead in P&L or gross margin terms even if it turns out to be a clearly Intel issue, as the perceived or real loss of performance may trigger an upgrade spree, sold unit counts inevitably dominated by Intel purchases. AMD has just started to catch up in overall performance, and in the worst case bug impact to Intel, they may even get competitive single-threaded performance. Also, there has been speculation that Apple has been evaluating ARM processors for some future laptops, and a sudden drop of the baseline is an interesting turn of events. While this in theory benefits the underdogs, financially Intel may well come out ahead due to their market hegemony.

haberman 9y ago

I could be wrong, but I take the "bug/flaw" language to mean this: the processor is doing exactly what it was designed to do (unlike the Pentium FDIV bug, for example). A new class of exploit was recently discovered, and these CPUs are vulnerable to this new exploit. But there was no bug in how these CPUs were implemented, and the only design flaw is that they failed to withstand a new class of exploit that was not known at the time they were designed. (I don't have any information that could confirm/deny this, it's just how I interpret their verbiage). I don't get the sense that they are trying to deceptively contradict only part of the previous statement.

foxylad 9y ago
My limited understanding is that the vulnerability is due to kernel memory protections not being applied during speculative execution, when the CPU is trying to second guess what the next instructions might be. Unless you are in PR, any reasonable person would expect a CPU touted as having kernel memory protection to protect it under all circumstances. I'm sure that the people who wrote the speculative execution code would have included that protection had they thought of it, and all developers would class it's omission as a bug. So yes, this is yet another example of awful PR, trying to cover up a serious mistake with careful language that makes it seem not their fault. My policy when I make a mistake is immediate disclosure, along with two commitments: to put the mistake right, and to amend processes to prevent similar mistakes in the future. It isn't clear how Intel can put this right, but perhaps a good discount on replacement parts might help. And they can certainly implement processes to catch such omissions in the future. So this press release (particularly combined with reports of execs selling stock) are appalling. Intel have badly damaged their brand, and I'll never buy another Intel processor again.
redcalx 9y ago
It's kind of semantics though isn't it? If I write a piece of software that follows the spec and fulfils the customer's need, but then someone tries to do something with it that we hadn't thought of and that results in a security hole... around here we call that a bug, a flaw, something we missed. Maybe it's reasonable to have not spotted the bug, but that wouldn't make it not a bug/flaw.

Danihan 9y ago

> Intel believes these exploits do not have the potential to corrupt, modify or delete data. Unless you view a key or password... then use it to corrupt, modify or delete data.

path411 9y ago
Bugs don't cause security leaks, it's the hackers that do! Software security is really just a social problem.

droopybuns 9y ago

I feel like a lot of really smart people are really naive about public relations. PR exists to protect the company from the masses and the lawyers. We in the tech community should not waste time personalizing a response to pr communications. We are not the target market. It is the general public and politicians they are trying to persuade. If they ameliorate them, they win and can move on to the next fight. They will play word games and fiddle with language. It is not worth responding to PR if you deeply understand the problem. You will only find problematic statements. You will never get satisfaction because satisfying the technical community is a fundamental error for anyone who knows what they are doing in public relations. There are other venues for us. Patch notes and tech forums are worthy of your time.

deleted 9y ago

[deleted]

ec109685 9y ago

> They said they verified Spectre attacks on AMD and ARM processors, as well. https://www.wired.com/story/critical-intel-flaw-breaks-basic-security-for-most-computers/ https://www.wired.com/story/critical-intel-flaw-breaks-basic...

noncoml 9y ago

> This is deceptive. It immediately mentions AMD to give the impression that AMD also suffer from the problem. It looks like (some?) AMD processors might be affected as well: "These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running them."[1] [1] https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...

arghwhat 9y ago
From what I can gather, one of the 3 issues found is Intel-only, very bad and very easy to exploit, and can be patched with a large performance hit. Another is harder to exploit, and has no known workaround (likely requiring new silicon to fix), and affects basically all micro-architectures in use today, including AMD's x86 silicon. The third, I know nothing of.
- BuildTheRobots 9y ago
  Ah, it must be serious, there's now a branded website [1] for it ;) I believe the Intel only issue is called "Meltdown" and the second is called "Spectre"; the attack website [1] has details of both. [1] https://meltdownattack.com/ https://meltdownattack.com/
  - smaddox 9y ago
    Reading the Meltdown paper [1], it's not clear why I keep seeing people say it's Intel only. The paper says quite clearly that other vendors' processors could be affected: "Instead, Meltdown exploits side-channel information available on most modern processors, e.g., modern Intel microarchitectures since 2010 and potentially on other CPUs of other vendors." [1] https://meltdownattack.com/meltdown.pdf https://meltdownattack.com/meltdown.pdf
    - pksadiq 9y ago
      > "Instead, Meltdown exploits side-channel information available on most modern processors, e.g., modern Intel microarchitectures since 2010 and potentially on other CPUs of other vendors." But their website faq says[0]: every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). .... Currently, we have only verified Meltdown on Intel processors.... [0] https://meltdownattack.com/#faq-systems-meltdown https://meltdownattack.com/#faq-systems-meltdown

tomxor 9y ago

>...pointing out what the exploits cannot do (corrupt/modify/delete). That statement is also untrue if you follow the implicit issue to it's inevitable exploitable end... Here is an equivalent statement of equal absurdity that intentionally neglects causality: "Our door lock design contains a bug. The bug does not make stuff in your house disappear, does not manifest junkies into the vicinity, nor does it make property spontaneously combust."

endorphone 9y ago

I am going to go on a limb and speculate that Intel probably knows more about this problem than most. They are being quite specific that the issue affects multiple devices, and I doubt they are lying. And coincidentally several other reports (from Google, Wired and others) are indicating that this issue crosses CPU makers. In that context, isn't you reply rather off the mark? If Intel's claim is correct, then being "defensive" seems entirely accurate given how many are foaming at the mouth at the prospect of some mortally wounded Intel.

gshulegaard 9y ago

> This is deceptive. In the first sentence it combines two statements: 1) bug/flaw in Intel products and 2) that it is unique to Intel. In the rest of the paragraph it then claims that the previous statements are incorrect, but only addressing the second point. This is excellent analysis. I guess my follow up question is has there been anything to suggest that AMD/ARM are or are not vulnerable in a similar manner? I read this as Intel trying to imply that other vendors weren't probed and/or may not have this specific design vulnerability but can still be vulnerable...which I consider a vapid statement designed to distract the reader. True, when a 0-day is found and disclosed it doesn't mean that there aren't other 0-days that haven't been found yet...but that has no relation to the significance of the newly disclosed vulnerability. I judge this statement even more harshly because the flaw is so serious it's under embargo until OS vendors can try to protect users. Additionally, AMD seems to have said their processors are not vulnerable (https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2)... Edit: Some more information from Google Project Zero: https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi... So maybe AMD and ARM are vulnerable? Edit 2: So it seems there are two slightly different attacks along this vector: Spectre and Meltdown. From the Google article(s) it seems Spectre affects Intel, AMD, ARM while Meltdown only affects Meltdown. This would appear to contradict the AMD statement regarding their processors not being affected. I am not hardware guy and information is still coming out...but I am judging this Intel press release slightly less harshly (although it still reads pretty vapid).

strmpnk 9y ago
The patch that was under question was related to a workaround for Meltdown, which makes AMD's note regarding the lack of necessity in agreement with the paper. The Spectre paper seems to be a bit less specific on how platforms might differ under explotation but very clearly states that it was verified to be possible. Workarounds for that problem will likely be much more application specific from what I can tell, but I have only skimmed that paper so far.
- strmpnk 9y ago
  Update: AMD has an official statement with a clear outline of the discussed vulnerabilities: https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution

fpoling 9y ago

Formally it is a bug in the spec, so indeed Intel products performs as designed. What is deceptive in the first part that the text does not tell that the design and specs were also done by Intel.