4 ms·

Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be

Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho. EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301 https://access.redhat.com/articles/3311301

JumpCrisscross 9y ago
> Very disingenuous of Intel tho This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable. Intel's communication, however, from the first press release to crap like this, has been disingenuous to the point that it arouses suspicion. Why are they being dishonest? Is there something more to be discovered? What else have they lied about? Textbook case of PR and IR incompetence.
- jacquesm 9y ago
  Well, they may have been more honest than they intended to be when they said that the CPUs were operating ´as designed´. Tinfoil hat stuff.
- BuildTheRobots 9y ago
  As much as I hate to say it, I think the Intel PR machine is working stunningly. Every geek I speak to will tell you the world's on fire. Every non-geek I speak to responds with "oh, really? if it's such a big problem how come no-one has heard about it? Oh, ok, well there might have been that one headline..." I am infuriated by Intel's response no end, however I'm also somewhat impressed. They seem to have completely avoided a PR disaster and their stock price is largely unaffected.
  - jayflux 9y ago
    Is that really good PR? Or just news that hasn't hit the mainstream because they don't understand it or doesn't affect them much.
    - cratermoon 9y ago
      It's good PR. If a mainstream media outlet looks into it they are predisposed to "hear" two views and weigh them equally. They'll get one from the OS/Security community saying "this is really bad" and one from Intel (via their spokespeople) saying "don't worry about it, we got it". Then their journalistic tendency will be to give more weight to what Intel say over what a bunch of "nerds" say, and the resulting headline will be "Intel fixing chip bug some say is puts the cloud at risk" or some such nonsense.
      - flukus 9y ago
        I thinks it's more a case of bad "marketing" from project zero. Had the stuck with a single name "spectre" (with 3 variants) then the media would have had a story that's much easier to understand and repeat/sell. When it's a case of "x affects a" and "y affects a, b and c" then the story gets to confusing for them and their readers.
  - ixtli 9y ago
    There's a 'too big to fail' thing going on here I think, because what you've said about Intel is exactly how I felt about Equifax's breach. At a certain point of terrible-ness people just shrug and carry on.
  - Momquist 9y ago
    > Every non-geek I speak to responds with "oh, really?" My take on it is that non-tech savvy people are now largely desensitized to any vulnerability discovery, as long as it hasn't been exploited in the wild. Computers have bugs? What's new? Intel's PR, good or bad, doesn't matter that much.
- hodgesrm 9y ago
  Without taking Intel's side there's another perspective. Meltdown/Spectre are severe and perhaps even unprecedented security problems but if you put them in the overall security context there are many other issues that outrank them at least from the perspective of non-technical users. 1. A majority of Americans using credit had their private data compromised in the 2017 Equifax breach. [0] That's just one of what are now countless breaches of data. The damage from Meltdown/Spectre is somewhat theoretical at this point whereas the data breaches have led to real fraud against countless individuals and business. 2. Even recent OS versions have large numbers of security bugs--see Greg Kroah-Hartmann's comments on obsolete kernels for specific Linux examples. [1] 3. State actors ranging from the US to North Korea have well-funded operations to steal or corrupt data. If they really want your data they will probably get it even if Meltdown/Spectre had not been discovered. Finally it's only fair to point out that some of the claims of Intel being disingenuous on the august Hacker News forum [2] turned out to be overblown--other processors are subject to some of the same problems and many users will not notice much difference in the patched systems. [0] https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... [1] http://kroah.com/log/blog/2018/01/06/meltdown-status/ http://kroah.com/log/blog/2018/01/06/meltdown-status/ [2] https://news.ycombinator.com/item?id=16064545 https://news.ycombinator.com/item?id=16064545
  - gaius 9y ago
    State actors ranging from the US to North Korea No-one really believes that the Norks with their steam-powered computers are hacking anything. Propaganda cuts both ways.
    - Fnoord 9y ago
      I was quite in the know in the 2nd hand PC market in the beginning of the '00s because one of the projects was I involved in was to get people who couldn't afford computer & internet access to our 2nd hand computer network, including with internet access. We were running practically on donated hardware (and ran on 100% free software), except for our main internal and public server which were purchased. It was called, translated, an "internet free place" because the word "[internet] pub" was protected by law. I suppose nowadays it'd be called a hackerspace of some kind but that word didn't exist back then. Now, if you'd seen the stuff which was thrown away... perfectly working computers from a few years old really. There were projects to get these to 2nd and 3rd world countries as well (though by other organisations than ours, since we were local to our city). With that in mind, and assuming computer hardware is still being tossed away after such short times of usage (I'd wager PC hardware is used more, but mobile phones are still being tossed like candy paper), I wonder if any IBM clones ever reached North Korean soil. If North Korea speculated on Bitcoins, which they supposedly did (with which computers?), they got some nice income out of that as well. Or would you recon this is all done outside of NK borders e.g. by spies?
- dingo_bat 9y ago
  They even tried to name the macro in Linux something like "INSECURE_KERNEL" instead of accurately describing that the insecurity lies in the CPU, not kernel.
maltalex 9y ago
I don't think that's the case. They're patching the issue in CPU microcode.
- pizlonator 9y ago
  My understanding is the hat they are only patching the indirect branch issue, so you’re still vulnerable to Spectre if you install the patches. They aren’t patching the (not indirect) conditional branch issue. That requires software changes or disabling speculative execution (which would have catastrophic perf cost).
signal11 9y ago
I can download microcode updates for Linux from Intel's website, and IIRC Ubuntu has shipped microcode updates before. I know Windows Update does deliver microcode updates, but thus far I'm unaware of Windows Update distributing any for Spectre. Intel is being very disingenuous when they say "contact your OEM/vendor for microcode updates". In consumer reality, vendors mostly won't provide updates, and even if they do, consumers won't install them. The only practical way to deliver microcode updates to Windows users is through Windows Update, so the real question is when these will make their way to Windows Update.

JumpCrisscross 9y ago

> Very disingenuous of Intel tho This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable. Intel's communication, however, from the first press release to crap like this, has been disingenuous to the point that it arouses suspicion. Why are they being dishonest? Is there something more to be discovered? What else have they lied about? Textbook case of PR and IR incompetence.

jacquesm 9y ago
Well, they may have been more honest than they intended to be when they said that the CPUs were operating ´as designed´. Tinfoil hat stuff.
BuildTheRobots 9y ago
As much as I hate to say it, I think the Intel PR machine is working stunningly. Every geek I speak to will tell you the world's on fire. Every non-geek I speak to responds with "oh, really? if it's such a big problem how come no-one has heard about it? Oh, ok, well there might have been that one headline..." I am infuriated by Intel's response no end, however I'm also somewhat impressed. They seem to have completely avoided a PR disaster and their stock price is largely unaffected.
- jayflux 9y ago
  Is that really good PR? Or just news that hasn't hit the mainstream because they don't understand it or doesn't affect them much.
  - cratermoon 9y ago
    It's good PR. If a mainstream media outlet looks into it they are predisposed to "hear" two views and weigh them equally. They'll get one from the OS/Security community saying "this is really bad" and one from Intel (via their spokespeople) saying "don't worry about it, we got it". Then their journalistic tendency will be to give more weight to what Intel say over what a bunch of "nerds" say, and the resulting headline will be "Intel fixing chip bug some say is puts the cloud at risk" or some such nonsense.
    - flukus 9y ago
      I thinks it's more a case of bad "marketing" from project zero. Had the stuck with a single name "spectre" (with 3 variants) then the media would have had a story that's much easier to understand and repeat/sell. When it's a case of "x affects a" and "y affects a, b and c" then the story gets to confusing for them and their readers.
- ixtli 9y ago
  There's a 'too big to fail' thing going on here I think, because what you've said about Intel is exactly how I felt about Equifax's breach. At a certain point of terrible-ness people just shrug and carry on.
- Momquist 9y ago
  > Every non-geek I speak to responds with "oh, really?" My take on it is that non-tech savvy people are now largely desensitized to any vulnerability discovery, as long as it hasn't been exploited in the wild. Computers have bugs? What's new? Intel's PR, good or bad, doesn't matter that much.
hodgesrm 9y ago
Without taking Intel's side there's another perspective. Meltdown/Spectre are severe and perhaps even unprecedented security problems but if you put them in the overall security context there are many other issues that outrank them at least from the perspective of non-technical users. 1. A majority of Americans using credit had their private data compromised in the 2017 Equifax breach. [0] That's just one of what are now countless breaches of data. The damage from Meltdown/Spectre is somewhat theoretical at this point whereas the data breaches have led to real fraud against countless individuals and business. 2. Even recent OS versions have large numbers of security bugs--see Greg Kroah-Hartmann's comments on obsolete kernels for specific Linux examples. [1] 3. State actors ranging from the US to North Korea have well-funded operations to steal or corrupt data. If they really want your data they will probably get it even if Meltdown/Spectre had not been discovered. Finally it's only fair to point out that some of the claims of Intel being disingenuous on the august Hacker News forum [2] turned out to be overblown--other processors are subject to some of the same problems and many users will not notice much difference in the patched systems. [0] https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breac... [1] http://kroah.com/log/blog/2018/01/06/meltdown-status/ http://kroah.com/log/blog/2018/01/06/meltdown-status/ [2] https://news.ycombinator.com/item?id=16064545 https://news.ycombinator.com/item?id=16064545
- gaius 9y ago
  State actors ranging from the US to North Korea No-one really believes that the Norks with their steam-powered computers are hacking anything. Propaganda cuts both ways.
  - Fnoord 9y ago
    I was quite in the know in the 2nd hand PC market in the beginning of the '00s because one of the projects was I involved in was to get people who couldn't afford computer & internet access to our 2nd hand computer network, including with internet access. We were running practically on donated hardware (and ran on 100% free software), except for our main internal and public server which were purchased. It was called, translated, an "internet free place" because the word "[internet] pub" was protected by law. I suppose nowadays it'd be called a hackerspace of some kind but that word didn't exist back then. Now, if you'd seen the stuff which was thrown away... perfectly working computers from a few years old really. There were projects to get these to 2nd and 3rd world countries as well (though by other organisations than ours, since we were local to our city). With that in mind, and assuming computer hardware is still being tossed away after such short times of usage (I'd wager PC hardware is used more, but mobile phones are still being tossed like candy paper), I wonder if any IBM clones ever reached North Korean soil. If North Korea speculated on Bitcoins, which they supposedly did (with which computers?), they got some nice income out of that as well. Or would you recon this is all done outside of NK borders e.g. by spies?
dingo_bat 9y ago
They even tried to name the macro in Linux something like "INSECURE_KERNEL" instead of accurately describing that the insecurity lies in the CPU, not kernel.

maltalex 9y ago

I don't think that's the case. They're patching the issue in CPU microcode.

pizlonator 9y ago
My understanding is the hat they are only patching the indirect branch issue, so you’re still vulnerable to Spectre if you install the patches. They aren’t patching the (not indirect) conditional branch issue. That requires software changes or disabling speculative execution (which would have catastrophic perf cost).

signal11 9y ago

I can download microcode updates for Linux from Intel's website, and IIRC Ubuntu has shipped microcode updates before. I know Windows Update does deliver microcode updates, but thus far I'm unaware of Windows Update distributing any for Spectre. Intel is being very disingenuous when they say "contact your OEM/vendor for microcode updates". In consumer reality, vendors mostly won't provide updates, and even if they do, consumers won't install them. The only practical way to deliver microcode updates to Windows users is through Windows Update, so the real question is when these will make their way to Windows Update.