5 ms·
By the way, can someone tell a reason why these parallel independent discoveries came during the same year as Project Zero? The vulnerability has been there for
by ptaipale 9y ago
By the way, can someone tell a reason why these parallel independent discoveries came during the same year as Project Zero? The vulnerability has been there for 20 years, and it is somehow strange that over the past two decades nobody thought of this, and now there are several who do and disclose it independently.
- SimonPStevens 9y agoIt's probably related to this phenomenon - https://en.wikipedia.org/wiki/Multiple_discovery https://en.wikipedia.org/wiki/Multiple_discovery I think it's also less statistically unlikely than you think. Thousands of security issues are discovered every year, it makes sense that some small number will be discovered in parallel. It looks like a big coincidence because you are focusing on the one parallel discovery, but if you consider it in the broad landscape of all discoveries then it's just statistically expected that there would be at least one parallel discovery.
- Terretta 9y agoTinfoil hat: Because we didn’t need it any more, or because the other side figured it out, so either way we needed to make sure it got disclosed and fixed. No tinfoil hat: Because the series of research to date connected enough dots it crossed a threshold and lightbulbs went off all over.
- xyzzyz 9y agoFrom the Meltdown paper: Jann disclosed the issue to Intel in June. The subsequent activity around the KAISER patch was the reason we started investigating this issue.
- mattnewton 9y agoThis is probably the real answer
- jvolkman 9y agoRecent article that talks about this: https://www.wired.com/story/meltdown-spectre-bug-collision-intel-chip-flaw-discovery/ https://www.wired.com/story/meltdown-spectre-bug-collision-i...
- ptaipale 9y agoThanks, that was a good read. Still, as they say in this article, without a tinfoil hat: "There’s no reason someone couldn’t have found this years ago instead of today."
- JosephHatfield 9y agoThe Project Zero staff along with other researchers are almost certainly keeping up with the latest papers in the field. I think it's not unlikely that these papers would lead them all towards the same set of interesting related unsolved problems.
- deleted 9y ago[deleted]
- collinmanderson 9y agoPublic research has hinted at the problem starting August 2016. https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)#History https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...