9 ms·

Huge real world performance impact, they didn't say how much but it looks like close to 100%. I smell a class action lawsuit coming.

by forgotpw2018 9y ago

pitaj 9y ago
Why? This wasn't gross incompetence in processor design, this kind of attack is completely new. I don't see how a class action could apply here, by IANAL
- Filligree 9y ago
  Doesn't stop people from filing one. They already have, in fact. I agree that it shouldn't get anywhere, but I'm not as sanguine about whether or not it actually will.
- jjeaff 9y ago
  It doesn't have to be gross incompetence. If you pay for something and it doesn't deliver as promised, you may be entitled to a partial or full refund.
- chrisper 9y ago
  If you know that your product is flawed, do you keep selling it or will you pull it from the shelves? To this date I can still buy broken Intel CPUs.... They knew about the flaw in June. Yet they still kept selling Coffee Lake CPUs. If my 8700k wouldn't still be significantly faster than Amd Ryzen (or I wouldn't have to also return the MB), I would have switched to an Amd in a heart beat.
  - djsumdog 9y ago
    To be fair to Intel, mitigating this type of issue isn't at all trivial. If it were, it could have been fixed in a microcode update. You can't rush a chip design for something as complicated as x86_64. There are long multi-year development cycles and tons of regression tests. With this they need to add even more tests before they can start on attacking the issues with the design.
    - pritambaral 9y ago
      > To be fair to Intel, mitigating this type of issue isn't at all trivial. It's understandable that they may not have been able to mitigate it in the 8th gen CPUs in just a few months, but they also put those CPUs out on the market, advertised them, and sold them, all the while they knew of their design flaw, without saying anything about it to the unsuspecting customer.
- rdtsc 9y ago
  Speculatively loading data across a protection boundary which is what happens in Meltdown can be argued to be incompetence or sneakiness. It certainly helps with benchmarks. Moreover it would be hard to say "everyone is doing it" because it seems so far besides the latest ARM processors, most of the other CPU architectures don't do it.
- krylon 9y ago
  > this kind of attack is completely new. Not really: http://www.daemonology.net/hyperthreading-considered-harmful/ http://www.daemonology.net/hyperthreading-considered-harmful... That was in 2005. It might be an over-generalization, but one could say that Intel made that same mistake (at least) twice.
Filligree 9y ago
More than a doubling of CPU use, but for consistency's sake: The other percentages we've been offered have been in terms of performance reduction. We were told to expect a range of 5-30%; this is about 60%. Somewhere a sysadmin's hair has started smoldering.
- metaobject 9y ago
  I’d go farther, anybody who is concerned with application performance may soon see/smell their hair smoldering. We write a lot of code that needs to run as fast as possible (processing, post-processing, generating real-time weather/satellite data) and I’m concerned about time windows and whether we’ll be able to meet requirements.
  - bsenftner 9y ago
    Meltdown is aptly named, as that is what's gonna happen to the global corporate services market, "efficiently" hosted in the cloud and scraping for profitability.
  - nine_k 9y ago
    I suppose these guys just don't apply the patch. They are not running in a public cloud with potentially hostile neighboring VMs; they run their own trusted code. They might choose to tighten perimeter security instead, in the short term.
  - toast0 9y ago
    Data processing where number crunching is the key problem may not be affected much. Data processing where fetching and assembling the data from many sources is likely to see larger slowdowns. Pure communications workloads are also likely to see larger slowdowns.
  - rdtsc 9y ago
    For pure computational cases Meltdown vulnerability remediation might not impact you as much. Meltdown fixes would affect applications that do a lot of syscalls - lots of socket IO, IPC stuff, small and frequent disk IO ops etc. You'll probably see a wide variety of benchmark results anything from no impact to things like above. So just make sure you measure carefully with your own workload.
Waterluvian 9y ago
I've been too focused on the tech that I forgot about the legal part of this. Is this why they've all given wishy-washy responses that take no responsibility and seemingly don't even admit there's a problem? Sounds like they expect massive legal recourse and have no real choice but to listen to their lawyers who are telling them to admit no guilt.
- QAPereo 9y ago
  Yes. They’re facing potentially ruinous class actions from individuals, and the legal fury of uncounted corporations which are going to suffer. It’s hard to imagine Intel dying, but if the impact on performance is so enormous, it could happen. So yes, they are in ass-covering-survival-mode. Having said that, I wouldn’t expect Intel to go down in legal flames, but the endless PR dripping is going to have to become a flood for a long time to recover.
- forgotpw2018 9y ago
  Exactly why. Even if the performance impact is 3%, that means the world has lost maybe 2% of its CPU power overnight. That's an utterly massive amount of hardware, many billions of dollars, maybe a trillian. It's not just the cost of the processors, but everything that contains them. Truly 'fixing' all the affected products would bankrupt a county but we should get a refund for the CPU's at the least
- rogerthis 9y ago
  And I add they will have legal issues in multiple countries, each with their own rules.
sillysaurus3 9y ago
Hopefully not. Lawsuits are a fine way to stifle innovation. Imagine how hard it would be to push through any idea at Intel. No one saw this coming. Things happen. It's impossible to predict every contingency. They acted in good faith. Also, heh, users are funny: "all other games i have work fin by the way so there must be a problem whit fortnite."
- QAPereo 9y ago
  If no one saw it coming, why is it all over papers which suddenly appeared in the last few days here? It seems that in the world of high assurance security, this was largely assumed, but not provable due to propriety walls.
- dk1138 9y ago
  If you bought a car that needed to go 60mph and a subsequent update to the car from the manufacturer for safety meant it could only go 30mph, there would be legal consequences. Of course you can't predict every contingency, but some of them you pay for.
  - jimmaswell 9y ago
    Did Intel ever specifically 100% promise a certain performance in their advertising? Do they have contracts having such promises in them with vendors?
    - Retric 9y ago
      I have seen Intel post benchmarks that are no longer correct. So, yes.
    - AFNobody 9y ago
      > Did Intel ever specifically 100% promise a certain performance in their advertising? Yes. They showcased benchmarks and paid people to benchmark/review their product along similar lines. https://ark.intel.com/products/96900/Intel-Xeon-Processor-E7-8894-v4-60M-Cache-2_40-GHz https://ark.intel.com/products/96900/Intel-Xeon-Processor-E7... etc.
nudgeee 9y ago
I think CPU designers are getting too much flak for this. The side effects of speculative execution has been around ever since their introduction. A compounding problem is how abstract software has become, it has made assumptions on the underlying execution model without a deeper understanding of its sublteties (sandboxing, containers, etc trying to guarantee process isolation). It’s the Law of Leaky Abstractions [0] at work. What is alarming is how long it has taken for us to collectively realize this is a problem. Hats off to the folks for uncovering this blind spot to us. [0] https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-abstractions/ https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-a...
- deleted 9y ago
  [deleted]
- Groxx 9y ago
  How does software abstraction impact this? (aside from the on-chip software/"software" doing the branch prediction)
Tempest1981 9y ago
With the Pentium floating point bug (1994), Intel offered to replace the defective CPUs. https://en.m.wikipedia.org/wiki/Pentium_FDIV_bug https://en.m.wikipedia.org/wiki/Pentium_FDIV_bug IIRC almost nobody took them up on the offer. But today there is far more cloud computing, so datacenters might.
- krylon 9y ago
  But back then, Intel could not deny that the FDIV bug was an actual bug in the CPU. Intel's press release on Meltdown is carefully worded to avoid admitting it's a bug in the CPU. But since the USA have the highest lawyer-per-citizen ratio in the world, it would be very interesting to see what happened if, say, Google sued Intel because from one day to the next, Google's electricity bills rise steeply, their servers crash, because the AC cannot handle the extra heat, ... , and Google demanded Intel pay for their damages. We live in very interesting times, indeed.
sshanky 9y ago
When they said "30%" they really meant it: the usage went from about 10% to about 40%, for an increase of 30.

Huge real world performance impact, they didn't say how much but it looks like close to 100%. I smell a class action lawsuit coming.

pitaj 9y ago

Why? This wasn't gross incompetence in processor design, this kind of attack is completely new. I don't see how a class action could apply here, by IANAL

Filligree 9y ago
Doesn't stop people from filing one. They already have, in fact. I agree that it shouldn't get anywhere, but I'm not as sanguine about whether or not it actually will.
jjeaff 9y ago
It doesn't have to be gross incompetence. If you pay for something and it doesn't deliver as promised, you may be entitled to a partial or full refund.
chrisper 9y ago
If you know that your product is flawed, do you keep selling it or will you pull it from the shelves? To this date I can still buy broken Intel CPUs.... They knew about the flaw in June. Yet they still kept selling Coffee Lake CPUs. If my 8700k wouldn't still be significantly faster than Amd Ryzen (or I wouldn't have to also return the MB), I would have switched to an Amd in a heart beat.
- djsumdog 9y ago
  To be fair to Intel, mitigating this type of issue isn't at all trivial. If it were, it could have been fixed in a microcode update. You can't rush a chip design for something as complicated as x86_64. There are long multi-year development cycles and tons of regression tests. With this they need to add even more tests before they can start on attacking the issues with the design.
  - pritambaral 9y ago
    > To be fair to Intel, mitigating this type of issue isn't at all trivial. It's understandable that they may not have been able to mitigate it in the 8th gen CPUs in just a few months, but they also put those CPUs out on the market, advertised them, and sold them, all the while they knew of their design flaw, without saying anything about it to the unsuspecting customer.
rdtsc 9y ago
Speculatively loading data across a protection boundary which is what happens in Meltdown can be argued to be incompetence or sneakiness. It certainly helps with benchmarks. Moreover it would be hard to say "everyone is doing it" because it seems so far besides the latest ARM processors, most of the other CPU architectures don't do it.
krylon 9y ago
> this kind of attack is completely new. Not really: http://www.daemonology.net/hyperthreading-considered-harmful/ http://www.daemonology.net/hyperthreading-considered-harmful... That was in 2005. It might be an over-generalization, but one could say that Intel made that same mistake (at least) twice.

Filligree 9y ago

More than a doubling of CPU use, but for consistency's sake: The other percentages we've been offered have been in terms of performance reduction. We were told to expect a range of 5-30%; this is about 60%. Somewhere a sysadmin's hair has started smoldering.

metaobject 9y ago
I’d go farther, anybody who is concerned with application performance may soon see/smell their hair smoldering. We write a lot of code that needs to run as fast as possible (processing, post-processing, generating real-time weather/satellite data) and I’m concerned about time windows and whether we’ll be able to meet requirements.
- bsenftner 9y ago
  Meltdown is aptly named, as that is what's gonna happen to the global corporate services market, "efficiently" hosted in the cloud and scraping for profitability.
- nine_k 9y ago
  I suppose these guys just don't apply the patch. They are not running in a public cloud with potentially hostile neighboring VMs; they run their own trusted code. They might choose to tighten perimeter security instead, in the short term.
- toast0 9y ago
  Data processing where number crunching is the key problem may not be affected much. Data processing where fetching and assembling the data from many sources is likely to see larger slowdowns. Pure communications workloads are also likely to see larger slowdowns.
- rdtsc 9y ago
  For pure computational cases Meltdown vulnerability remediation might not impact you as much. Meltdown fixes would affect applications that do a lot of syscalls - lots of socket IO, IPC stuff, small and frequent disk IO ops etc. You'll probably see a wide variety of benchmark results anything from no impact to things like above. So just make sure you measure carefully with your own workload.

Waterluvian 9y ago

I've been too focused on the tech that I forgot about the legal part of this. Is this why they've all given wishy-washy responses that take no responsibility and seemingly don't even admit there's a problem? Sounds like they expect massive legal recourse and have no real choice but to listen to their lawyers who are telling them to admit no guilt.

QAPereo 9y ago
Yes. They’re facing potentially ruinous class actions from individuals, and the legal fury of uncounted corporations which are going to suffer. It’s hard to imagine Intel dying, but if the impact on performance is so enormous, it could happen. So yes, they are in ass-covering-survival-mode. Having said that, I wouldn’t expect Intel to go down in legal flames, but the endless PR dripping is going to have to become a flood for a long time to recover.
forgotpw2018 9y ago
Exactly why. Even if the performance impact is 3%, that means the world has lost maybe 2% of its CPU power overnight. That's an utterly massive amount of hardware, many billions of dollars, maybe a trillian. It's not just the cost of the processors, but everything that contains them. Truly 'fixing' all the affected products would bankrupt a county but we should get a refund for the CPU's at the least
rogerthis 9y ago
And I add they will have legal issues in multiple countries, each with their own rules.

sillysaurus3 9y ago

Hopefully not. Lawsuits are a fine way to stifle innovation. Imagine how hard it would be to push through any idea at Intel. No one saw this coming. Things happen. It's impossible to predict every contingency. They acted in good faith. Also, heh, users are funny: "all other games i have work fin by the way so there must be a problem whit fortnite."

QAPereo 9y ago
If no one saw it coming, why is it all over papers which suddenly appeared in the last few days here? It seems that in the world of high assurance security, this was largely assumed, but not provable due to propriety walls.
dk1138 9y ago
If you bought a car that needed to go 60mph and a subsequent update to the car from the manufacturer for safety meant it could only go 30mph, there would be legal consequences. Of course you can't predict every contingency, but some of them you pay for.
- jimmaswell 9y ago
  Did Intel ever specifically 100% promise a certain performance in their advertising? Do they have contracts having such promises in them with vendors?
  - Retric 9y ago
    I have seen Intel post benchmarks that are no longer correct. So, yes.
  - AFNobody 9y ago
    > Did Intel ever specifically 100% promise a certain performance in their advertising? Yes. They showcased benchmarks and paid people to benchmark/review their product along similar lines. https://ark.intel.com/products/96900/Intel-Xeon-Processor-E7-8894-v4-60M-Cache-2_40-GHz https://ark.intel.com/products/96900/Intel-Xeon-Processor-E7... etc.

nudgeee 9y ago

I think CPU designers are getting too much flak for this. The side effects of speculative execution has been around ever since their introduction. A compounding problem is how abstract software has become, it has made assumptions on the underlying execution model without a deeper understanding of its sublteties (sandboxing, containers, etc trying to guarantee process isolation). It’s the Law of Leaky Abstractions [0] at work. What is alarming is how long it has taken for us to collectively realize this is a problem. Hats off to the folks for uncovering this blind spot to us. [0] https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-abstractions/ https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-a...

deleted 9y ago
[deleted]
Groxx 9y ago
How does software abstraction impact this? (aside from the on-chip software/"software" doing the branch prediction)

Tempest1981 9y ago

With the Pentium floating point bug (1994), Intel offered to replace the defective CPUs. https://en.m.wikipedia.org/wiki/Pentium_FDIV_bug https://en.m.wikipedia.org/wiki/Pentium_FDIV_bug IIRC almost nobody took them up on the offer. But today there is far more cloud computing, so datacenters might.

krylon 9y ago
But back then, Intel could not deny that the FDIV bug was an actual bug in the CPU. Intel's press release on Meltdown is carefully worded to avoid admitting it's a bug in the CPU. But since the USA have the highest lawyer-per-citizen ratio in the world, it would be very interesting to see what happened if, say, Google sued Intel because from one day to the next, Google's electricity bills rise steeply, their servers crash, because the AC cannot handle the extra heat, ... , and Google demanded Intel pay for their damages. We live in very interesting times, indeed.

sshanky 9y ago

When they said "30%" they really meant it: the usage went from about 10% to about 40%, for an increase of 30.