5 ms·

Wow. This is bad for Intel. Industry experts have been expressing concerns for this for ten years. Does this open Intel up to possible repercussions?

alphaalpha101 9y ago
When has any tech company ever had to face any sort of repercussions for bugs? I wholeheartedly think they should have to. But they don't.
forapurpose 9y ago
> Industry experts have been expressing concerns for this for ten years. AFAICT, de Raadt was concerned about Intel in general, but not the recent exploits in particular. We can find endless criticisms of every major company from the last 10 years (including on HN!); picking this one mailing list posting is bit arbitrary in the context of these exploits, even if de Raadt makes some good general points.
- cat199 9y ago
  > AFAICT, de Raadt was concerned about Intel in general, but not the recent exploits in particular. Really? How do you explain the following: > These processors are buggy as hell, and some of these bugs don't just cause development/debugging problems, but will ASSUREDLY be exploitable from userland code. > Note that some errata like AI65, AI79, AI43, AI39, AI90, AI99 scare the hell out of us. > AI90 is exploitable on some operating systems (but not OpenBSD running default binaries). Plus huge development effort in stack/address randomization, W^X pages, dynamic kernel and c library relinking, etc as simply 'concern about intel in general' but not any details 'in particular'? Even if the stated position is not true, it would be logically inconsistent to assume someone whose operating system project focuses on 'security and correctness' to simply be making general statements and not being concerned with actual low-level details..
  - cthalupa 9y ago
    What forapurpose said: > but not the recent exploits in particular What you said: > but not any details 'in particular'? Looking at the list of items Theo gave, most of them were fixed previously, and the others, at least to my largely uneducated eye, do not appear to be related to this specific issue. Unless I am mistaken (and that's certainly possible!) it was not at all related to Spectre/Meltdown
- mrep 9y ago
  I work with a bunch of hardware engineers who used to work at intel and the really knowledgeable ex-intel guy I know said speculative execution has always been known to be risky but actually exploiting it was presumed to be very difficult/impossible. Looking back, I should have asked him how intel evaluates security risks considering how much of modern day computing uses it (which makes it an extremely valuable black hack exploit since it can work on practically every computer).
  - mannykannot 9y ago
    In practice, if you cannot demonstrate an exploit, your concerns will be heavily discounted, and this is a case in point. Even if you do show an exploit, attempts will often be made to dismiss it as infeasible in practice (this is for security issues in general, not specifically Intel.)
- GalacticDomin8r 9y ago
  They were more than general points. Please don't poo-poo this as some sort of horoscope doom and gloom post. He specifically pointed out the the issues addressed in the recent disclosures: > It is not just buggy, but Intel has gone further and defined "new ways to handle page tables" (see page 58). The MMU, page tables, and TLB are all directly related.
  - forapurpose 9y ago
    > Please don't poo-poo this as some sort of horoscope doom and gloom post That wasn't my intent at all. de Raadt makes good, generally applicable points.

alphaalpha101 9y ago

When has any tech company ever had to face any sort of repercussions for bugs? I wholeheartedly think they should have to. But they don't.

forapurpose 9y ago

> Industry experts have been expressing concerns for this for ten years. AFAICT, de Raadt was concerned about Intel in general, but not the recent exploits in particular. We can find endless criticisms of every major company from the last 10 years (including on HN!); picking this one mailing list posting is bit arbitrary in the context of these exploits, even if de Raadt makes some good general points.

cat199 9y ago
> AFAICT, de Raadt was concerned about Intel in general, but not the recent exploits in particular. Really? How do you explain the following: > These processors are buggy as hell, and some of these bugs don't just cause development/debugging problems, but will ASSUREDLY be exploitable from userland code. > Note that some errata like AI65, AI79, AI43, AI39, AI90, AI99 scare the hell out of us. > AI90 is exploitable on some operating systems (but not OpenBSD running default binaries). Plus huge development effort in stack/address randomization, W^X pages, dynamic kernel and c library relinking, etc as simply 'concern about intel in general' but not any details 'in particular'? Even if the stated position is not true, it would be logically inconsistent to assume someone whose operating system project focuses on 'security and correctness' to simply be making general statements and not being concerned with actual low-level details..
- cthalupa 9y ago
  What forapurpose said: > but not the recent exploits in particular What you said: > but not any details 'in particular'? Looking at the list of items Theo gave, most of them were fixed previously, and the others, at least to my largely uneducated eye, do not appear to be related to this specific issue. Unless I am mistaken (and that's certainly possible!) it was not at all related to Spectre/Meltdown
mrep 9y ago
I work with a bunch of hardware engineers who used to work at intel and the really knowledgeable ex-intel guy I know said speculative execution has always been known to be risky but actually exploiting it was presumed to be very difficult/impossible. Looking back, I should have asked him how intel evaluates security risks considering how much of modern day computing uses it (which makes it an extremely valuable black hack exploit since it can work on practically every computer).
- mannykannot 9y ago
  In practice, if you cannot demonstrate an exploit, your concerns will be heavily discounted, and this is a case in point. Even if you do show an exploit, attempts will often be made to dismiss it as infeasible in practice (this is for security issues in general, not specifically Intel.)
GalacticDomin8r 9y ago
They were more than general points. Please don't poo-poo this as some sort of horoscope doom and gloom post. He specifically pointed out the the issues addressed in the recent disclosures: > It is not just buggy, but Intel has gone further and defined "new ways to handle page tables" (see page 58). The MMU, page tables, and TLB are all directly related.
- forapurpose 9y ago
  > Please don't poo-poo this as some sort of horoscope doom and gloom post That wasn't my intent at all. de Raadt makes good, generally applicable points.