5 ms·

I'm kind of okay with that as long as they're not holding out to give themselves an advantage. If somebody is going to discover these, why not a cloud provider

I'm kind of okay with that as long as they're not holding out to give themselves an advantage. If somebody is going to discover these, why not a cloud provider who can protect huge numbers of clients early? If it was a little guy who discovered it, then everyone except maybe a fraction of a percent of the world (or nobody if the discoverer runs no servers) gets the same late start.

boulos 9y ago
Disclosure: I work on Google Cloud. Project Zero disclosed this to Intel, AMD and ARM on June 1 as stated in the blogpost [1]. I believe an independent researcher working somewhere else (or even at home) would have done the same, as indeed the parallel independent discoveries ultimately did. [1] https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi...
- andrewstuart2 9y ago
  Yeah, I'm not saying anything was withheld. I'm just pointing out that Google probably had a fix in mind, tested, and deployed much sooner than most. Not a bad thing, rather a good thing that's just a benefit of having been the ones to discover it. You can patch your own machines with a lot lower global risk than sharing outside the company.
- ptaipale 9y ago
  By the way, can someone tell a reason why these parallel independent discoveries came during the same year as Project Zero? The vulnerability has been there for 20 years, and it is somehow strange that over the past two decades nobody thought of this, and now there are several who do and disclose it independently.
  - SimonPStevens 9y ago
    It's probably related to this phenomenon - https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery I think it's also less statistically unlikely than you think. Thousands of security issues are discovered every year, it makes sense that some small number will be discovered in parallel. It looks like a big coincidence because you are focusing on the one parallel discovery, but if you consider it in the broad landscape of all discoveries then it's just statistically expected that there would be at least one parallel discovery.
  - Terretta 9y ago
    Tinfoil hat: Because we didn’t need it any more, or because the other side figured it out, so either way we needed to make sure it got disclosed and fixed. No tinfoil hat: Because the series of research to date connected enough dots it crossed a threshold and lightbulbs went off all over.
  - xyzzyz 9y ago
    From the Meltdown paper: Jann disclosed the issue to Intel in June. The subsequent activity around the KAISER patch was the reason we started investigating this issue.
    - mattnewton 9y ago
      This is probably the real answer
  - jvolkman 9y ago
    Recent article that talks about this: https://www.wired.com/story/meltdown-spectre-bug-collision-intel-chip-flaw-discovery/ https://www.wired.com/story/meltdown-spectre-bug-collision-i...
    - ptaipale 9y ago
      Thanks, that was a good read. Still, as they say in this article, without a tinfoil hat: "There’s no reason someone couldn’t have found this years ago instead of today."
  - JosephHatfield 9y ago
    The Project Zero staff along with other researchers are almost certainly keeping up with the latest papers in the field. I think it's not unlikely that these papers would lead them all towards the same set of interesting related unsolved problems.
  - deleted 9y ago
    [deleted]
  - collinmanderson 9y ago
    Public research has hinted at the problem starting August 2016. https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)#History https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...
djsumdog 9y ago
I doesn't look like any of the *BSD people were let in on this issue until very recently. Apple, Microsoft and the Linux Kernel devs seem to have been given priority. It kinda shows where Linux is right now in the global landscape compared to two decades ago. Funding and time/people for the kernel comes from the big players (IBM, Intel, et. al.) and distribution decisions have created a monoculture, making the big Linux distros feel like they're part of the corporate/national tech culture and less community centered.
- sudhirj 9y ago
  I read, don’t have a citation though, that they were excluded because they refused to respect the embargo, not because of who they were.
  - marcolussetti 9y ago
    That's more relating to OpenBSD than the other BSDs. FreeBSD was informed during the embargo (someone on another threads said at the behest of Netflix) but in late December.
- TeMPOraL 9y ago
  Didn't the *BSD folks have history of unilaterally breaking embargoes on security issues? That could further explain why they weren't notified ahead of time.
  - deleted 9y ago
    [deleted]

boulos 9y ago

Disclosure: I work on Google Cloud. Project Zero disclosed this to Intel, AMD and ARM on June 1 as stated in the blogpost [1]. I believe an independent researcher working somewhere else (or even at home) would have done the same, as indeed the parallel independent discoveries ultimately did. [1] https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi...

andrewstuart2 9y ago
Yeah, I'm not saying anything was withheld. I'm just pointing out that Google probably had a fix in mind, tested, and deployed much sooner than most. Not a bad thing, rather a good thing that's just a benefit of having been the ones to discover it. You can patch your own machines with a lot lower global risk than sharing outside the company.
ptaipale 9y ago
By the way, can someone tell a reason why these parallel independent discoveries came during the same year as Project Zero? The vulnerability has been there for 20 years, and it is somehow strange that over the past two decades nobody thought of this, and now there are several who do and disclose it independently.
- SimonPStevens 9y ago
  It's probably related to this phenomenon - https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery I think it's also less statistically unlikely than you think. Thousands of security issues are discovered every year, it makes sense that some small number will be discovered in parallel. It looks like a big coincidence because you are focusing on the one parallel discovery, but if you consider it in the broad landscape of all discoveries then it's just statistically expected that there would be at least one parallel discovery.
- Terretta 9y ago
  Tinfoil hat: Because we didn’t need it any more, or because the other side figured it out, so either way we needed to make sure it got disclosed and fixed. No tinfoil hat: Because the series of research to date connected enough dots it crossed a threshold and lightbulbs went off all over.
- xyzzyz 9y ago
  From the Meltdown paper: Jann disclosed the issue to Intel in June. The subsequent activity around the KAISER patch was the reason we started investigating this issue.
  - mattnewton 9y ago
    This is probably the real answer
- jvolkman 9y ago
  Recent article that talks about this: https://www.wired.com/story/meltdown-spectre-bug-collision-intel-chip-flaw-discovery/ https://www.wired.com/story/meltdown-spectre-bug-collision-i...
  - ptaipale 9y ago
    Thanks, that was a good read. Still, as they say in this article, without a tinfoil hat: "There’s no reason someone couldn’t have found this years ago instead of today."
- JosephHatfield 9y ago
  The Project Zero staff along with other researchers are almost certainly keeping up with the latest papers in the field. I think it's not unlikely that these papers would lead them all towards the same set of interesting related unsolved problems.
- deleted 9y ago
  [deleted]
- collinmanderson 9y ago
  Public research has hinted at the problem starting August 2016. https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)#History https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...

djsumdog 9y ago

I doesn't look like any of the *BSD people were let in on this issue until very recently. Apple, Microsoft and the Linux Kernel devs seem to have been given priority. It kinda shows where Linux is right now in the global landscape compared to two decades ago. Funding and time/people for the kernel comes from the big players (IBM, Intel, et. al.) and distribution decisions have created a monoculture, making the big Linux distros feel like they're part of the corporate/national tech culture and less community centered.

sudhirj 9y ago
I read, don’t have a citation though, that they were excluded because they refused to respect the embargo, not because of who they were.
- marcolussetti 9y ago
  That's more relating to OpenBSD than the other BSDs. FreeBSD was informed during the embargo (someone on another threads said at the behest of Netflix) but in late December.
TeMPOraL 9y ago
Didn't the *BSD folks have history of unilaterally breaking embargoes on security issues? That could further explain why they weren't notified ahead of time.
- deleted 9y ago
  [deleted]