4 ms·
> However, this side-channel mechanism could enable someone to potentially extract some information that otherwise would not be accessible to software from proc
by deckard1 9y ago
> However, this side-channel mechanism could enable someone to potentially extract some information that otherwise would not be accessible to software from processors that are performing as designed and not based on a flaw or bug.
I'm having trouble parsing this bit of lawyer speak.
In the prior sentence they say nothing is new. Then in this sentence, they are saying that there is something new. I'd say "potentially extract information that would not be accessible" as definitely not "performing as designed" unless it were "based on a flaw or bug." That is, if you take security seriously. I mean, how could it not be? Are you saying that this attack is by design?
Is... is this an NSA canary? Did you guys just admit that this is not a flaw by design? Blink once if the men in black are listening, twice if they know we know they are listening.
- ealexhudson 9y agoTo be honest, they're saying two things which are both simultaneously true: * you can access information that, by design, the processor would ordinarily prevent access to * the fault is not a flaw or bug, but inherent in the design of the processor The intent of the design was to keep the information secure, and the features of the design to do that are working as intended. Other features of the design, intended to increase performance, are also working correctly, but turn out to leak information in certain circumstances. There's no clear analogy in the physical world I can think of, but I don't think this is weasel-speak. Exfiltration of data accidentally through a side-channel, like here, is very difficult to design against.
- noway421 9y ago"We succeeded on the design of it, but failed on the security goal."