4 ms·
Disclosure: I work on Google Cloud. Project Zero disclosed this to Intel, AMD and ARM on June 1 as stated in the blogpost [1]. I believe an independent researc
by boulos 9y ago
Disclosure: I work on Google Cloud.
Project Zero disclosed this to Intel, AMD and ARM on June 1 as stated in the blogpost [1]. I believe an independent researcher working somewhere else (or even at home) would have done the same, as indeed the parallel independent discoveries ultimately did.
[1] https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi...
- andrewstuart2 9y agoYeah, I'm not saying anything was withheld. I'm just pointing out that Google probably had a fix in mind, tested, and deployed much sooner than most. Not a bad thing, rather a good thing that's just a benefit of having been the ones to discover it. You can patch your own machines with a lot lower global risk than sharing outside the company.
- ptaipale 9y agoBy the way, can someone tell a reason why these parallel independent discoveries came during the same year as Project Zero? The vulnerability has been there for 20 years, and it is somehow strange that over the past two decades nobody thought of this, and now there are several who do and disclose it independently.
- SimonPStevens 9y agoIt's probably related to this phenomenon - https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery I think it's also less statistically unlikely than you think. Thousands of security issues are discovered every year, it makes sense that some small number will be discovered in parallel. It looks like a big coincidence because you are focusing on the one parallel discovery, but if you consider it in the broad landscape of all discoveries then it's just statistically expected that there would be at least one parallel discovery.
- Terretta 9y agoTinfoil hat: Because we didn’t need it any more, or because the other side figured it out, so either way we needed to make sure it got disclosed and fixed. No tinfoil hat: Because the series of research to date connected enough dots it crossed a threshold and lightbulbs went off all over.
- xyzzyz 9y agoFrom the Meltdown paper: Jann disclosed the issue to Intel in June. The subsequent activity around the KAISER patch was the reason we started investigating this issue.
- mattnewton 9y agoThis is probably the real answer
- jvolkman 9y agoRecent article that talks about this: https://www.wired.com/story/meltdown-spectre-bug-collision-intel-chip-flaw-discovery/ https://www.wired.com/story/meltdown-spectre-bug-collision-i...
- ptaipale 9y agoThanks, that was a good read. Still, as they say in this article, without a tinfoil hat: "There’s no reason someone couldn’t have found this years ago instead of today."
- JosephHatfield 9y agoThe Project Zero staff along with other researchers are almost certainly keeping up with the latest papers in the field. I think it's not unlikely that these papers would lead them all towards the same set of interesting related unsolved problems.
- deleted 9y ago[deleted]
- collinmanderson 9y agoPublic research has hinted at the problem starting August 2016. https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)#History https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...