4 ms·
When F00F bug hit 20 years ago, Intel reacted the same way
- criddell 9y agoConsidering the volume of what Intel ships and the complexity of their product, it's astounding that we are reaching back 20 years when looking for a comparable situation.
- busterarm 9y agoExcept it's pretty clear that this bug has been in Intel products for many years. I'd even debate whether this is a comparable situation, because that issue was discovered quickly. This one has been present, lurking, and possibly exploited for quite a long time.
- skynetv2 9y ago> Except it's pretty clear that this bug has been in Intel products for many years. existing vs knowing is different, dont you say? as the saying goes - computers are always in a state of error, you only notice the problem when enough occur simultaneously to make the problem visible .... or something like that.
- freeone3000 9y agoThe bug has existed since speculative execution was introduced, 17 years ago. A 3-year gap between world-breaking bugs isn't that exceptional (I hope!).
- criddell 9y agoEven so, that's pretty good. Large software companies have disaster scale bugs many times every year.
- maxhallinan 9y agoCan you provide examples of the companies and bugs you're referring to?
- bilkoo 9y agoI doubt we can even find a contemporary software company with that kind of market share to begin with, let alone the severity of bugs. Windows in the 90s perhaps?
- mrkeen 9y agoBuggy is the resting state of software. Just tracking bugs is a billion dollar industry (Atlassian, etc.) Personally? Tonight my Firefox was rendering all images as black until I rebooted. When I press the 'stop' button after watching something on the HBO app, it doesn't stop. https://www.reddit.com/r/softwaregore/ https://www.reddit.com/r/softwaregore/ These aren't hypothetical vulnerabilities that a skilled attacker could discover after years of searching (as is the case with these CPU bugs) - they're right there on the surface.
- maxhallinan 9y agoI guess we understand "disaster scale" differently.
- megablast 9y agoHow many times did you have to press stop to get access to the hbo’s servers?
- decebalus1 9y agoApple
- tinymollusk 9y agoI know you're using hyperbole for effect, but I have to (lightly) poke fun at you for called something that happened 14 years ago as "world-breaking" ;).
- kinkrtyavimoodh 9y agoExactly, whenever there is any mention of an aviation incident, I am always in awe of how infrequent these are despite tens of millions of people flying every year more or less round the clock. What a massive human achievement.
- Fnoord 9y agoWhat kind of soft- and hardware (specifically architecture) is being used in past and modern aircraft? Sources/references appreciated.
- ken47 9y agoThis isn't surprising. Intel has established a pattern of BS'ing when confronted with their mistakes / wrongdoings. Do they think their consumers aren't smart enough to see through it? I was already leaning towards AMD's processors for my next system, and Intel's handling of this recent episode does not help their chances. I'd say Linus feels the same: https://lkml.org/lkml/2018/1/3/797 https://lkml.org/lkml/2018/1/3/797
- HenryBemis 9y agoIntel (like any other who wants to run a monopoly) has been trying to evade any responsibilities in wrong-doings either within (FOOF, the 2 new vulns) or without ("inappropriate" practices against competition a couple of decades ago). This time they got caught with THEIR poop on OUR lunch-box. They will deny wrong-doing, they will downplay it. I wonder if these vulns are exploitable, who had prior knowledge (e.g. NSA had 20 years of abuse for MS SME), and if they patch them, what new backdoor they now got (because conspiracy nuts apart, no one burns a card unless they got a better one and they just lost control of the previous one).
- sounds 9y agoIntel didn't burn this card. They got burned. By at least three different groups and an individual all at once. What to learn from it? One thing's for sure, Intel could cut the BS when faced with bad PR. It comes across as tone-deaf, defensive, and uninspiring.
- dasil003 9y agoTheir direct customers? Yes, but alternatives are thin on the ground. Their investors? No. This bland corporate blame dispersal is exactly the kind of language that investors are used to reading all the time, and that will placate professional investors enough to avoid a bloodbath. Techies who understand how bad this is don't have the PR skills or reputation to counter, because even most smart business/money people don't have the background or patience to understand the theoretical implications. Partial analogies and shrill responses don't have much effect as people are very used to techies getting passionate and upset about all kinds of things that they never feel the effects of. At the end of the day, short of widespread hacking with economic consequences, there won't be enough visible impact for investors to be bothered. If and when that happens Intel will deal with it, they really have no upside to do anything but spin the current situation in the most positive light. The more interesting question is what kind of design changes they make in future designs. Because F00F was a trivial fix compared to this, and as far as I know there hasn't been a security revelation of this impact for CPU design in the modern era. You'd have to go back to a time when things were much simpler and easier to change anyway. If Intel engineering doesn't take this seriously and we see half-baked mitigations in new chips that's when I go long on the competition, because that indicates true incompetence whereas the current statements indicate nothing other than savvy PR.
- yuhong 9y agoF00F is probably worse in practice than the recent timing attacks. For the average user, I think even the perf hit from the workaround for the timing attack is probably not worth it.