5 ms·

Are Meltdown and Spectre pre-installed or do I have to download them via the Intel ME? \s I don't know how they have the audacity to release new CPUs while all

Are Meltdown and Spectre pre-installed or do I have to download them via the Intel ME? \s I don't know how they have the audacity to release new CPUs while all their products just went to shit...

t3rmi 9y ago
The partnership with Radeon was a big deal sometime ago. They couldn't not release it. AMD would have been pissed.
pjmlp 9y ago
What else are you going to buy instead?
- dna_polymerase 9y ago
  Currently, Ryzen.
  - gpderetta 9y ago
    not immune from spectre.
    - dna_polymerase 9y ago
      Sigh, yes it is, Ryzen is only vulnerable to Spectre if eBPF JIT is turned on, which is not the default.
      - gpderetta 9y ago
        You are thinking of a specific attack that uses the 2nd spectre vulnerability (poisoning of the indirect branch prediction) to attack the kernel. I'm sure in the following weeks other attacks to the kernel will appear that do not use the eBPF. The same vulnerability can be in principle be used to attack other processes. Still there are both software and firmware mitigations for this attack. The real elephant in the room is the first spectre vulnerability (exploiting the normal jump predictor), which allows untrusted code (think JS) to read anything in the same process. Apparently most [1] CPUs are affected by this. There is currently no mitigation for this, other than rewriting applications to use separate address spaces, and even then, I think with carefully crafted inputs even that can be exploited. [1] apparently simple, in-order cpus are not, but in principle there is no reason for the attack to work there as well. edit: another possible mitigation for spectre v1 is converting all bound checks controlled by untrusted input to force non-speculation (via if-conversion). It is going to take a very long time to covert all applications (it might be easier for VMs and JITs).
      - aseipp 9y ago
        1) Ryzen is absolutely vulnerable to Spectre, however desperately you don't want to think so. (I don't want it either; I just bought a Threadripper 1950X, after all) 2) If you actually think the eBPF JIT being turned off is going to save you and that Ryzen is magically immune because it's off: you're deluding yourself completely. Thinking eBPF is the key or whatever is a full misread of the actual vulnerability... Attacks never get worse, they only get better. You are guaranteed to see more exploits that do not leverage eBPF, but other components of the kernel to compose gadgets. Modern systems are millions of LOC; there's ample surface area for this to happen.
prewett 9y ago
Yeah, because all they have to do is just tweak some code and re-release... /s It takes 2 - 4 years to design a chip. If Intel doesn't release the new chip they started designing 2 - 4 years ago, they waste that development cost, fall behind AMD, and you complain that they are behind the times. If they do release the chip you complain they haven't fixed the bug you just learned about a week ago. It took a year for everyone to fix their software, and you want Intel to magically come out with new hardware? Sheesh. I think all the "Intel sucks" comments should have a disclaimer "Full disclosure: I've never designed hardware in my life, I have no idea how to run a business, I really just hate Intel and this is an excuse to vent my hatred."
- dna_polymerase 9y ago
  Nope. This bug is far from new. Intel knew about this since 2012 [0]. I don't expect them to release a fix within a year or something. I know that CPU design is far from easy or doable within weeks. But how they handled the whole matter shows that they don't care. Intel sucks, that's true. They should admit that they produced shit and start talking to their customers and show that they care. Oh and also, who in their right mind would buy a CPU with those bugs? [0]: https://twitter.com/TheSimha/status/949361495468642304 https://twitter.com/TheSimha/status/949361495468642304
  - whywhywhywhy 9y ago
    >They should admit that they produced shit and start talking to their customers and show that they care. Someone correct me if I'm wrong but isn't almost every modern CPU vulnerable in some way with Spectre? If so isn't every modern CPU manufacturer "producing shit" in your eyes?
    - dna_polymerase 9y ago
      Most modern AMD CPUs are not vulnerable or at least not to the full extent, so no not all CPU manufacturers are producing shit.
      - deleted 9y ago

Are Meltdown and Spectre pre-installed or do I have to download them via the Intel ME? \s I don't know how they have the audacity to release new CPUs while all their products just went to shit...

t3rmi 9y ago

The partnership with Radeon was a big deal sometime ago. They couldn't not release it. AMD would have been pissed.

pjmlp 9y ago

What else are you going to buy instead?

dna_polymerase 9y ago
Currently, Ryzen.
- gpderetta 9y ago
  not immune from spectre.
  - dna_polymerase 9y ago
    Sigh, yes it is, Ryzen is only vulnerable to Spectre if eBPF JIT is turned on, which is not the default.
    - gpderetta 9y ago
      You are thinking of a specific attack that uses the 2nd spectre vulnerability (poisoning of the indirect branch prediction) to attack the kernel. I'm sure in the following weeks other attacks to the kernel will appear that do not use the eBPF. The same vulnerability can be in principle be used to attack other processes. Still there are both software and firmware mitigations for this attack. The real elephant in the room is the first spectre vulnerability (exploiting the normal jump predictor), which allows untrusted code (think JS) to read anything in the same process. Apparently most [1] CPUs are affected by this. There is currently no mitigation for this, other than rewriting applications to use separate address spaces, and even then, I think with carefully crafted inputs even that can be exploited. [1] apparently simple, in-order cpus are not, but in principle there is no reason for the attack to work there as well. edit: another possible mitigation for spectre v1 is converting all bound checks controlled by untrusted input to force non-speculation (via if-conversion). It is going to take a very long time to covert all applications (it might be easier for VMs and JITs).
    - aseipp 9y ago
      1) Ryzen is absolutely vulnerable to Spectre, however desperately you don't want to think so. (I don't want it either; I just bought a Threadripper 1950X, after all) 2) If you actually think the eBPF JIT being turned off is going to save you and that Ryzen is magically immune because it's off: you're deluding yourself completely. Thinking eBPF is the key or whatever is a full misread of the actual vulnerability... Attacks never get worse, they only get better. You are guaranteed to see more exploits that do not leverage eBPF, but other components of the kernel to compose gadgets. Modern systems are millions of LOC; there's ample surface area for this to happen.

prewett 9y ago

Yeah, because all they have to do is just tweak some code and re-release... /s It takes 2 - 4 years to design a chip. If Intel doesn't release the new chip they started designing 2 - 4 years ago, they waste that development cost, fall behind AMD, and you complain that they are behind the times. If they do release the chip you complain they haven't fixed the bug you just learned about a week ago. It took a year for everyone to fix their software, and you want Intel to magically come out with new hardware? Sheesh. I think all the "Intel sucks" comments should have a disclaimer "Full disclosure: I've never designed hardware in my life, I have no idea how to run a business, I really just hate Intel and this is an excuse to vent my hatred."

dna_polymerase 9y ago
Nope. This bug is far from new. Intel knew about this since 2012 [0]. I don't expect them to release a fix within a year or something. I know that CPU design is far from easy or doable within weeks. But how they handled the whole matter shows that they don't care. Intel sucks, that's true. They should admit that they produced shit and start talking to their customers and show that they care. Oh and also, who in their right mind would buy a CPU with those bugs? [0]: https://twitter.com/TheSimha/status/949361495468642304 https://twitter.com/TheSimha/status/949361495468642304
- whywhywhywhy 9y ago
  >They should admit that they produced shit and start talking to their customers and show that they care. Someone correct me if I'm wrong but isn't almost every modern CPU vulnerable in some way with Spectre? If so isn't every modern CPU manufacturer "producing shit" in your eyes?
  - dna_polymerase 9y ago
    Most modern AMD CPUs are not vulnerable or at least not to the full extent, so no not all CPU manufacturers are producing shit.
    - deleted 9y ago