5 ms·

Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at

Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at the forefront.

dmitrygr 9y ago
That does not change the fact that SUM(security,speed,price /due to Si area/) == CONST
- garmaine 9y ago
  That equation doesn’t hold, as open source software has demonstrated time and time again.
  - cwyers 9y ago
    http://heartbleed.com/ http://heartbleed.com/
  - dmitrygr 9y ago
    I was talking about hardware For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.
    - sitkack 9y ago
      You outline only a single solution of which there are many. The thing RISC-V gets you is the ability to iterate on an implementation while still running the body of existing code. As ridiculous as it seems, this hasn't been possible before. RISC-V didn't technically need to exist but it did politically and legally. I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.
      - Momquist 9y ago
        I think this equation actually makes sense when only the same people/minds are changing the factors. If the same team is given the task of improving a product, chances are they will be close minded and only able to tweak say security at the expense of the other two. To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.
UncleEntity 9y ago
Seems more like jumping on the bandwagon to me... I thought this was all down to an implementation detail and has nothing to do with ISAs.
- shawnz 9y ago
  If you read the very short article: > the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.
  - mlinksva 9y ago
    Alternative short article if RISC-V community is target audience: > [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]
bobajeff 9y ago
Being open doesn't gain you much here either. At the end of the day there is no "updating" it once a vulnerability is found.
- nitrogen 9y ago
  It does make it more likely that a compatible replacement can be found on the market, though.
Nokinside 9y ago
High performance microarchitectures for RISCV are still going to be proprietary. Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.

Neither the article nor the title imply that. They are saying open is better, colaborative is better, and that RISCV is a chance to start over with security at the forefront.

dmitrygr 9y ago

That does not change the fact that SUM(security,speed,price /due to Si area/) == CONST

garmaine 9y ago
That equation doesn’t hold, as open source software has demonstrated time and time again.
- cwyers 9y ago
  http://heartbleed.com/ http://heartbleed.com/
- dmitrygr 9y ago
  I was talking about hardware For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.
  - sitkack 9y ago
    You outline only a single solution of which there are many. The thing RISC-V gets you is the ability to iterate on an implementation while still running the body of existing code. As ridiculous as it seems, this hasn't been possible before. RISC-V didn't technically need to exist but it did politically and legally. I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.
    - Momquist 9y ago
      I think this equation actually makes sense when only the same people/minds are changing the factors. If the same team is given the task of improving a product, chances are they will be close minded and only able to tweak say security at the expense of the other two. To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.

UncleEntity 9y ago

Seems more like jumping on the bandwagon to me... I thought this was all down to an implementation detail and has nothing to do with ISAs.

shawnz 9y ago
If you read the very short article: > the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.
- mlinksva 9y ago
  Alternative short article if RISC-V community is target audience: > [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]

bobajeff 9y ago

Being open doesn't gain you much here either. At the end of the day there is no "updating" it once a vulnerability is found.

nitrogen 9y ago
It does make it more likely that a compatible replacement can be found on the market, though.

Nokinside 9y ago

High performance microarchitectures for RISCV are still going to be proprietary. Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.