3 ms·
I share your concern. Based on my admittedly loose understanding, although the Spectre vulnerability is "more difficult" to exploit, I suspect it's a matter of
by bhauer 9y ago
I share your concern. Based on my admittedly loose understanding, although the Spectre vulnerability is "more difficult" to exploit, I suspect it's a matter of time before exploits become more common. And the Spectre vulnerability is the one that requires a BIOS/firmware update.
So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page. Meanwhile, some of the bigger server motherboard vendors (e.g., SuperMicro) are not yet prepared to supply firmware updates for recent motherboards.
Recognizing that the operating system vendors/maintainers are not responsible for our systems' BIOS and hardware, the flippant advice to "talk with your device's vendor" gives me a sinking feeling. (E.g., Microsoft: "Consult with the device manufacturer about the firmware version that has the appropriate update for your CPU.") As a technical person, I am going to find it difficult to bring all of my hardware—especially the older hardware—up to snuff for coping with these vulnerabilities. I fear for people who are less technically inclined.
- cthalupa 9y ago>And the Spectre vulnerability is the one that requires a BIOS/firmware update. One of the Spectre variants. The other isn't mitigated by it and will require an lfence on your sensitive areas of apps.
- moe 9y agoThis is a key detail that gets glossed over too much for my liking. No OS or Firmware update will fully fix Spectre. All applications that interpret untrusted code (such as Web browsers) also have to be patched. https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd6533e9 https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd653...
- rhizome 9y agoSo that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page Buy stock in Gigabyte, MSI, etc.
- danieldk 9y agoMicrocode updates can be applied on boot through the BIOS/EFI firmware, but also by the operating system. Linux (I don't know about Windows) has facilities to update the microcode on boot: https://wiki.archlinux.org/index.php/microcode https://wiki.archlinux.org/index.php/microcode https://wiki.debian.org/Microcode https://wiki.debian.org/Microcode Also, directly from Intel: While the regular approach to getting this microcode update is via a BIOS update, Intel realizes that this can be an administrative hassle. The Linux operating system has a mechanism to update the microcode after booting. For example, this file will be used by the operating system mechanism if the file is placed in the /etc/firmware directory of the Linux system. Source: https://downloadcenter.intel.com/download/27337/Linux-Processor-Microcode-Data-File https://downloadcenter.intel.com/download/27337/Linux-Proces... Apple probably delivers them through EFI updates, but of course, getting updated EFI firmware from Apple was never a problem.