4 ms·

This depends on what you consider 'big'. To me, the 'biggest' problem here is Spectre which affects all modern high-performance processors, regardless of make

This depends on what you consider 'big'. To me, the 'biggest' problem here is Spectre which affects all modern high-performance processors, regardless of make or model due to it being a failure of a fundamental technique used to create them. The Meltdown bug is not more serious than Spectre, if anything, its the reverse as Meltdown has a realistic mitigation. I see no attempt by Intel to minimise this as it quite clearly is an industry-wide problem, don't start looking for scapegoats where there is none. There isn't always someone at fault.

JdeBP 9y ago
If you haven't seen what nukeop is referring to, then you need to read the discussions listed at https://news.ycombinator.com/item?id=16076601 https://news.ycombinator.com/item?id=16076601 .
mtgx 9y ago
Spectre is more difficult to exploit. Plus, as the top commenter said, it's more difficult/less effective to exploit it on AMD still. The "worse" part of Spectre is mainly about the fact that it affects everyone (but not to the same degree). But on a per chip-maker basis, Intel is still getting the shortest end of the stick here.
- electronvolt 9y ago
  It's definitely true that Meltdown is a more immediate problem--but Spectre is basically the problem that will last. We can move kernel memory into another process space, take the perf hit, and correct most of the meltdown problems. Spectre style issues had JS pulling browser process memory using timing--the patches being "put every page in its own process" (Chrome) and "don't let people get accurate timings" (Firefox). They are way worse in the grand scheme of things, because even if they aren't as easy to exploit, they will continue to show up, probably for the foreseeable future (next 5-10 years), long after Meltdown is patched and old news.
  - akvadrako 9y ago
    What? The whole idea that you can run untrusted code on your machine in the same process as secure data is ridiculous. Of course every website needs it's own process. It should really be in it's own VM too.
    - digi_owl 9y ago
      Or how about we stop perusing services that demand that we run 200+k of JS just to look at a few lines of text and images?

JdeBP 9y ago

If you haven't seen what nukeop is referring to, then you need to read the discussions listed at https://news.ycombinator.com/item?id=16076601 https://news.ycombinator.com/item?id=16076601 .

mtgx 9y ago

Spectre is more difficult to exploit. Plus, as the top commenter said, it's more difficult/less effective to exploit it on AMD still. The "worse" part of Spectre is mainly about the fact that it affects everyone (but not to the same degree). But on a per chip-maker basis, Intel is still getting the shortest end of the stick here.

electronvolt 9y ago
It's definitely true that Meltdown is a more immediate problem--but Spectre is basically the problem that will last. We can move kernel memory into another process space, take the perf hit, and correct most of the meltdown problems. Spectre style issues had JS pulling browser process memory using timing--the patches being "put every page in its own process" (Chrome) and "don't let people get accurate timings" (Firefox). They are way worse in the grand scheme of things, because even if they aren't as easy to exploit, they will continue to show up, probably for the foreseeable future (next 5-10 years), long after Meltdown is patched and old news.
- akvadrako 9y ago
  What? The whole idea that you can run untrusted code on your machine in the same process as secure data is ridiculous. Of course every website needs it's own process. It should really be in it's own VM too.
  - digi_owl 9y ago
    Or how about we stop perusing services that demand that we run 200+k of JS just to look at a few lines of text and images?