4 ms·
Intel PR monkeys are trying to take AMD down with them, let's make this clear: For the 3 bugs, the biggest one only affect Intel CPUs, for bug 2 and 3: AMD bu
by nukeop 9y ago
Intel PR monkeys are trying to take AMD down with them, let's make this clear:
For the 3 bugs, the biggest one only affect Intel CPUs, for bug 2 and 3:
AMD bug only affects THE SAME PROCESS, unlike Intel, which allows exploits to cross processes:
https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi...
"As shown, AMD was only vulnerable to "the ability to read data inside mis-speculated execution within the same process, without crossing any privilege boundaries."
- TickleSteve 9y agoThis depends on what you consider 'big'. To me, the 'biggest' problem here is Spectre which affects all modern high-performance processors, regardless of make or model due to it being a failure of a fundamental technique used to create them. The Meltdown bug is not more serious than Spectre, if anything, its the reverse as Meltdown has a realistic mitigation. I see no attempt by Intel to minimise this as it quite clearly is an industry-wide problem, don't start looking for scapegoats where there is none. There isn't always someone at fault.
- JdeBP 9y agoIf you haven't seen what nukeop is referring to, then you need to read the discussions listed at https://news.ycombinator.com/item?id=16076601 https://news.ycombinator.com/item?id=16076601 .
- mtgx 9y agoSpectre is more difficult to exploit. Plus, as the top commenter said, it's more difficult/less effective to exploit it on AMD still. The "worse" part of Spectre is mainly about the fact that it affects everyone (but not to the same degree). But on a per chip-maker basis, Intel is still getting the shortest end of the stick here.
- electronvolt 9y agoIt's definitely true that Meltdown is a more immediate problem--but Spectre is basically the problem that will last. We can move kernel memory into another process space, take the perf hit, and correct most of the meltdown problems. Spectre style issues had JS pulling browser process memory using timing--the patches being "put every page in its own process" (Chrome) and "don't let people get accurate timings" (Firefox). They are way worse in the grand scheme of things, because even if they aren't as easy to exploit, they will continue to show up, probably for the foreseeable future (next 5-10 years), long after Meltdown is patched and old news.
- akvadrako 9y agoWhat? The whole idea that you can run untrusted code on your machine in the same process as secure data is ridiculous. Of course every website needs it's own process. It should really be in it's own VM too.
- digi_owl 9y agoOr how about we stop perusing services that demand that we run 200+k of JS just to look at a few lines of text and images?
- static_noise 9y agoWhich would be a more appropriate term for the word "monkey" in this context? With monkey I associate being uncoordinated and stupid. I am very sure that this is not the case.
- JdeBP 9y agopeople.
- tzahola 9y agoshills
- nukeop 9y agogoons
- ForHackernews 9y ago"PR flacks" has a long and (dis?)honourable history http://www.edsonpr.com/NEWS/Cheklist_summer06.pdf http://www.edsonpr.com/NEWS/Cheklist_summer06.pdf
- ajobaccount2017 9y agoYou meant "PR flaks"?
- ForHackernews 9y agoThat's up for debate! http://grammarist.com/spelling/flack-flak/ http://grammarist.com/spelling/flack-flak/ http://www.prnewsonline.com/prnewsblog/flackflak-which-do-you-prefer/ http://www.prnewsonline.com/prnewsblog/flackflak-which-do-yo...
- executesorder66 9y agoassholes
- deleted 9y ago[deleted]
- zurn 9y agoWhere is that AMD quote from? The "As shown" text does not appear on that web page. In the Meltdown paper, the authors report that they couldn't yet make the proof-of-concept exploit work on AMD or ARM, despite having confirmed the general vulnerability on those processors. So based on current knowledge, AMD and ARM are vulnerable to Meltdown with quite a high probability.
- nukeop 9y agoMeltdown exploits Intel's branch predictor behavior which is not present in other manufacturers' CPUs.
- zurn 9y agoDepends on what you mean by Meltdown. The paper defines Meltdown ambigiously, the author variously refer to the Meltdown attack, the Meltdown exploit (= PoC), the Meltdown bug (= vulnerability). The current PoC created by the researchers doesn't work on other manufacturer's CPU's, but the vulnerability and the Meltdown class of attacks should work on other manufacturer's CPUs. Or at least we don't know any reason it shouldn't. The authors' "toy example" works on AMD and ARM too. (See the section 6.4 in the paper).
- specialist 9y agoReading everyone's comments, knowing nothing about this stuff, I had a random question: Does all this create an opportunity for another chip line (architecture) to capture some of the server market? I'm thinking specifically of SPARC. How far behind is SPARC now? A decade? Is that gap surmountable? Given that 1) both AMD and Intel have issues, and 2) the commentariat have written the variety of ARMs are a mess too, and 3) maybe the people who care (those with server farms) will mitigate risks by adding a completely different architecture to the mix (prefer hetero vs mono culture). Just curious.
- lod723 9y agoSPARC does speculative execution, so it would be vulnerable to Spectre too.
- binarycrusader 9y agoHowever, I believe Solaris uses separate address spaces for user and kernel on SPARC. So that should avoid meltdown at least. Also, it is unclear whether it allows speculation beyond privilege boundaries and it is also unclear whether ordering semantics for memory are different enough to mitigate somewhat. I wish I still had access to modern sparc hardware to find out. While it’s best to assume everything is vulnerable unless proven otherwise I’d really like to see a thorough evaluation.