4 ms·

Thanks for writing this. I didn't like the opening paragraph either, and your comment is a better rebuttal than I could have written. Colin, I think this is a

by dsacco 9y ago

Thanks for writing this. I didn't like the opening paragraph either, and your comment is a better rebuttal than I could have written. Colin, I think this is a good perspective on Spectre and Meltdown, but it feels like the entire opening paragraph was an unnecessary attempt at a "me too" that implies you're the modern father of these sorts of attacks when that isn't really the case. I understand you're establishing credibility and expertise (and you have both), but it's disingenuous to begin with, The story of these attacks starts in late 2004, and then go on to describe your own work. I think the rest of your post has its own utility without writing a narrative of these attacks that inserts you at the beginning of them.

cperciva 9y ago
I spent a long time wondering about this. Honestly, I think I am (along with Osvik and Tromer) modern father of these sorts of attacks. (See my reply to pbsd for why.) I think people in the field recognize my credibility and expertise here, and for them that paragraph is superfluous; but I was aiming this blog post at a wider audience (hence the effort spent on non-technical analogies to help them understand the issues) so I thought it was important to explain my background to people who had never heard of side channel attacks before.
- idlewords 9y ago
  If you're writing for a broader audience, then all the more reason to omit this history. It's like hearing about Darth Vader's childhood; people just want you to get to the good part. I like to think of it this way: readers from a general audience have a certain mental budget for understanding that they bring to an article like this. Once they exhaust that budget, you've lost them. So it helps to take special care to spend it on your key points. It also, if I can be frank, makes you look hungry for credit, which you'll get more of if you play it cool.
  - tanderson92 9y ago
    I have no background in computer architecture security or security at all, and appreciated the background of how he saw his work fit into the current day. Especially so because cperciva's original paper was being widely shared on HN in the ensuing Spectre/Meltdown threads.
  - cperciva 9y ago
    Fair enough. My personal writing style tends towards the narrative "start at the beginning and tell the story in chronological order" but I certainly understand the desire to "get to the good part". If I ever write a blog post about scrypt and all the work which has come after it, maybe I'll skip the lengthy analysis of how Tarsnap customers inspired me to investigate the topic of password-based key derivation. :-)
- tptacek 9y ago
  Another straightforward way to handle this is to bury the lede a little bit, and begin by briefly describing the previous cache work. That saves you from having to make an elaborate explanation of your specific claim on the history here. "Show, don't tell".

by dsacco 9y ago

cperciva 9y ago

I spent a long time wondering about this. Honestly, I think I am (along with Osvik and Tromer) modern father of these sorts of attacks. (See my reply to pbsd for why.) I think people in the field recognize my credibility and expertise here, and for them that paragraph is superfluous; but I was aiming this blog post at a wider audience (hence the effort spent on non-technical analogies to help them understand the issues) so I thought it was important to explain my background to people who had never heard of side channel attacks before.

idlewords 9y ago
If you're writing for a broader audience, then all the more reason to omit this history. It's like hearing about Darth Vader's childhood; people just want you to get to the good part. I like to think of it this way: readers from a general audience have a certain mental budget for understanding that they bring to an article like this. Once they exhaust that budget, you've lost them. So it helps to take special care to spend it on your key points. It also, if I can be frank, makes you look hungry for credit, which you'll get more of if you play it cool.
- tanderson92 9y ago
  I have no background in computer architecture security or security at all, and appreciated the background of how he saw his work fit into the current day. Especially so because cperciva's original paper was being widely shared on HN in the ensuing Spectre/Meltdown threads.
- cperciva 9y ago
  Fair enough. My personal writing style tends towards the narrative "start at the beginning and tell the story in chronological order" but I certainly understand the desire to "get to the good part". If I ever write a blog post about scrypt and all the work which has come after it, maybe I'll skip the lengthy analysis of how Tarsnap customers inspired me to investigate the topic of password-based key derivation. :-)
tptacek 9y ago
Another straightforward way to handle this is to bury the lede a little bit, and begin by briefly describing the previous cache work. That saves you from having to make an elaborate explanation of your specific claim on the history here. "Show, don't tell".