4 ms·

That's like if Takata claimed it wasn't a production issue in Takata airbags, it was an issue that affected any airbag that was designed like Takata airbags. I

That's like if Takata claimed it wasn't a production issue in Takata airbags, it was an issue that affected any airbag that was designed like Takata airbags. It's a bunch of bullshit trying to dance around the fact that Intel shipped faulty products for years. The fact that other similar products may also be faulty isn't a valid excuse.

chairmanwow 9y ago
I'm not sure that calling it faulty is exactly fair. I feel like the attack is actually pretty brilliant, and has been non-obviously "vulnerable" for years.
- betterunix2 9y ago
  It would be like Takata claiming their airbags are not a problem because all airbags can kill infants. There is a problem that uniquely affects one manufacturer's product line, and another problem that affects many manufacturers. Intel has been shipping chips that are uniquely and more severely affected by these attacks for many years now. They were ignorant, sure, but they did have a uniquely vulnerable design.
- jonknee 9y ago
  The same can be said for many security vulnerabilities, but that doesn't make them any less faulty. Shellshock exploited a bug that had been in Bash for 25 years (!), but being non-obvious isn't a free pass. I am not angry at Intel and in general think they do a good job, but trying to dodge blame here comes off sounding pathetic.
- emn13 9y ago
  The attack is pretty brilliant; but it's also not quite novel. Cache-timing attacks aren't new; certainly CPU suppliers should have known the general issues at hand for... at least a decade? See e.g. Colin Percival's somewhat related attack on hyperthreading way back in 2005: http://www.daemonology.net/papers/htt.pdf http://www.daemonology.net/papers/htt.pdf Actually exploiting the information leakage isn't easy; and its compounded by the secrecy surrounding cpu internals. So I think they definitely deserve some blame here. Yes, the PoC is new. But the attack surface was widely known more than a decade ago, and they chose to punt the issue onto software; a solution that was unlikely to really hold water.
  - contrarian_ 9y ago
    2006: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190.1003&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190... From the abstract: > Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels.
    - emn13 9y ago
      Hey, there you go! I kind of doubt Intel really didn't know about this risk. They were cutting corners; that deserves some opprobrium - especially given their market-dominating position over this timespan.
ch4ck 9y ago
That's like if Master Lock claimed it wasn't a production issue in Master locks, it was an issue that affected any lock that was designed like Master locks. It's a bunch of bullshit trying to dance around the fact that Master Lock shipped faulty products for years. The fact that other similar products may also be faulty isn't a valid excuse.
- x14 9y ago
  I mean, it's not like a Master Lock is hard to pick or shim. Good comparison ;)

chairmanwow 9y ago

I'm not sure that calling it faulty is exactly fair. I feel like the attack is actually pretty brilliant, and has been non-obviously "vulnerable" for years.

betterunix2 9y ago
It would be like Takata claiming their airbags are not a problem because all airbags can kill infants. There is a problem that uniquely affects one manufacturer's product line, and another problem that affects many manufacturers. Intel has been shipping chips that are uniquely and more severely affected by these attacks for many years now. They were ignorant, sure, but they did have a uniquely vulnerable design.
jonknee 9y ago
The same can be said for many security vulnerabilities, but that doesn't make them any less faulty. Shellshock exploited a bug that had been in Bash for 25 years (!), but being non-obvious isn't a free pass. I am not angry at Intel and in general think they do a good job, but trying to dodge blame here comes off sounding pathetic.
emn13 9y ago
The attack is pretty brilliant; but it's also not quite novel. Cache-timing attacks aren't new; certainly CPU suppliers should have known the general issues at hand for... at least a decade? See e.g. Colin Percival's somewhat related attack on hyperthreading way back in 2005: http://www.daemonology.net/papers/htt.pdf http://www.daemonology.net/papers/htt.pdf Actually exploiting the information leakage isn't easy; and its compounded by the secrecy surrounding cpu internals. So I think they definitely deserve some blame here. Yes, the PoC is new. But the attack surface was widely known more than a decade ago, and they chose to punt the issue onto software; a solution that was unlikely to really hold water.
- contrarian_ 9y ago
  2006: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190.1003&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190... From the abstract: > Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels.
  - emn13 9y ago
    Hey, there you go! I kind of doubt Intel really didn't know about this risk. They were cutting corners; that deserves some opprobrium - especially given their market-dominating position over this timespan.

ch4ck 9y ago

That's like if Master Lock claimed it wasn't a production issue in Master locks, it was an issue that affected any lock that was designed like Master locks. It's a bunch of bullshit trying to dance around the fact that Master Lock shipped faulty products for years. The fact that other similar products may also be faulty isn't a valid excuse.

x14 9y ago
I mean, it's not like a Master Lock is hard to pick or shim. Good comparison ;)