10 ms·

How a 22-Year-Old Discovered Meltdown and Spectre

137 points by bloat 9y ago

nerdponx 9y ago
Horn wasn’t looking to discover a major vulnerability in the world’s computer chips Maybe that's why he was the first to find it. He was looking where nobody else had thought to look, and he just so happened to have the combination of knowledge and resources (edit: and talent) to find a flaw there.
- godelmachine 9y ago
  >>"he just so happened to have the combination of knowledge" He had found security glitches in his school's computers network as a kid. Also, he was hired by a security research firm while he was still an undergrad. In addition to knowledge and resources, he also had the knack.
  - nerdponx 9y ago
    Absolutely. Did not mean to discount his obvious natural talent!
  - merb 9y ago
    He‘s german and Trust me finding a Security issue in german School Networks is not a big deal
    - HarryHirsch 9y ago
      That's right, when you do that in the US in any school the on-site cops come and arrest you. Initiative, competence and creativity are as a rule not prized in American education, conformity and athletic prowess are.
      - merb 9y ago
        well I basically meant it differently, but that's bad aswell..
      - TomMarius 9y ago
        He meant that the networks often aren't secured at all, so it's very easy to break into them.
    - chisleu 9y ago
      American here. Ditto (source: kicked out of high school and college for violation of TOS^H^H^H Acceptable Use Policy)
      - nerdponx 9y ago
        Out of curiosity, what did you do that was so bad as to get you kicked out of school twice?
        termhn 9y ago
        It doesn't even have to be bad. I was very nearly kicked out of my middle school just for booting from (!) my own live Linux USB drive on a school computer.
        chisleu 9y ago
        In High school I discovered the admin's secret account password was "god". (1995 maybe? I was 15) In college (1997? I was 17) I downloaded the source code of the unix client for back orifice. I read some of the source because I was interested in socket programming and reading Unix Network Programming. I compiled it, and deleted it without running it. They were on edge because "god" from high school called to warn them about me.
        Apocryphon 9y ago
        Did the admin literally watch Hackers and use that password as a goof
megaman22 9y ago
I miss all the time I used to have to screw around with random things in my teens and early twenties. There's way too much adulting getting in the way as you get older...
seba_dos1 9y ago
Is there anything particularly special about his age to make such a big fuss about it? Sure, this thing is worth an article like that, but it's not the age that makes it remarkable. People this age can just be perfectly capable to do stuff like that. What would have changed in perception of this article if he was not 22, but 32 years old? Would it still be mentioned in the title?
- zitterbewegung 9y ago
  It makes a better headline.
- mhandley 9y ago
  Being young is often an advantage when finding something really elusive that is obvious with hindsight - I think Meltdown and at least Spectre 1 fall in this category. When you're older, you get influenced more by how things are meant to work, whereas when you're younger (or just new to an area), you make fewer assumptions. You ask the questions no-one else thought were worth asking, because the answer couldn't possibly be true - but then it is after all.
  - mstade 9y ago
    So what you're saying is that it'd be more impressive if he was older?
  - TrickyRick 9y ago
    There's a pretty clear confirmation bias here though. The persons asking the questions no one else thinks worth asking which don't lead to major breakthroughs are just "stupid" or "lack experience".
- PuffinBlue 9y ago
  We (as a collective society) seem to find excellence in youth 'staggering'. I'm not sure if it's because we have a general perception that youth is when you should learn a thing, you then get a bit older and get good at it, then get a bit older and do great things with that ability, then sort of forget it all and be too old to be useful.
wyldfire 9y ago
> When a fellow researcher asked him about another possible aspect of processor design that might be vulnerable to attack, Horn said, with a brief-but-telling smile: "I’ve been wondering about it but I have not looked into it." Anyone who was at RWC2018 who can tell us what this item was? Presumably it's too technical for bloomberg's readership and not secret.
- Macuyiko 9y ago
  Probably the comment regarding Trusted Execution Environments. The talk is online: https://www.youtube.com/watch?v=6O8LTwVfTVs https://www.youtube.com/watch?v=6O8LTwVfTVs
gyyfl 9y ago
I thought meltdown and spectre were found simultaneously and independently by multiple groups?
deleted 9y ago
[deleted]
vatotemking 9y ago
In typical hackernews fashion, most of the comment (even the top comment) is someone downplaying someone else's brilliance. Why cant you just be happy for the kid? Some people are just plain better than you. And its OKAY. Most of us here are average, and will probably never see our own success story published like this. Kid has done and contributed so much at a young age. He's clearly way above average, judging from the reaction of his peers in the netsec community. His skills has benefited us all. His achievement should be celebrated, not met with bitterness.
- TomMarius 9y ago
  He's brilliant; but it's not about the age. I'm in a similar position to him (working on a very senior position in a big enterprise even though I'm in my very early twenties, I'm even younger than him) and I can assure you people like us don't like others pointing out our age. Focus on our achievements, our knowledge and our experience.

137 points by bloat 9y ago

Horn wasn’t looking to discover a major vulnerability in the world’s computer chips Maybe that's why he was the first to find it. He was looking where nobody else had thought to look, and he just so happened to have the combination of knowledge and resources (edit: and talent) to find a flaw there.

godelmachine 9y ago
>>"he just so happened to have the combination of knowledge" He had found security glitches in his school's computers network as a kid. Also, he was hired by a security research firm while he was still an undergrad. In addition to knowledge and resources, he also had the knack.
- nerdponx 9y ago
  Absolutely. Did not mean to discount his obvious natural talent!
- merb 9y ago
  He‘s german and Trust me finding a Security issue in german School Networks is not a big deal
  - HarryHirsch 9y ago
    That's right, when you do that in the US in any school the on-site cops come and arrest you. Initiative, competence and creativity are as a rule not prized in American education, conformity and athletic prowess are.
    - merb 9y ago
      well I basically meant it differently, but that's bad aswell..
    - TomMarius 9y ago
      He meant that the networks often aren't secured at all, so it's very easy to break into them.
  - chisleu 9y ago
    American here. Ditto (source: kicked out of high school and college for violation of TOS^H^H^H Acceptable Use Policy)
    - nerdponx 9y ago
      Out of curiosity, what did you do that was so bad as to get you kicked out of school twice?
      - termhn 9y ago
        It doesn't even have to be bad. I was very nearly kicked out of my middle school just for booting from (!) my own live Linux USB drive on a school computer.
      - chisleu 9y ago
        In High school I discovered the admin's secret account password was "god". (1995 maybe? I was 15) In college (1997? I was 17) I downloaded the source code of the unix client for back orifice. I read some of the source because I was interested in socket programming and reading Unix Network Programming. I compiled it, and deleted it without running it. They were on edge because "god" from high school called to warn them about me.
        Apocryphon 9y ago
        Did the admin literally watch Hackers and use that password as a goof

megaman22 9y ago

I miss all the time I used to have to screw around with random things in my teens and early twenties. There's way too much adulting getting in the way as you get older...

seba_dos1 9y ago

Is there anything particularly special about his age to make such a big fuss about it? Sure, this thing is worth an article like that, but it's not the age that makes it remarkable. People this age can just be perfectly capable to do stuff like that. What would have changed in perception of this article if he was not 22, but 32 years old? Would it still be mentioned in the title?

zitterbewegung 9y ago
It makes a better headline.
mhandley 9y ago
Being young is often an advantage when finding something really elusive that is obvious with hindsight - I think Meltdown and at least Spectre 1 fall in this category. When you're older, you get influenced more by how things are meant to work, whereas when you're younger (or just new to an area), you make fewer assumptions. You ask the questions no-one else thought were worth asking, because the answer couldn't possibly be true - but then it is after all.
- mstade 9y ago
  So what you're saying is that it'd be more impressive if he was older?
- TrickyRick 9y ago
  There's a pretty clear confirmation bias here though. The persons asking the questions no one else thinks worth asking which don't lead to major breakthroughs are just "stupid" or "lack experience".
PuffinBlue 9y ago
We (as a collective society) seem to find excellence in youth 'staggering'. I'm not sure if it's because we have a general perception that youth is when you should learn a thing, you then get a bit older and get good at it, then get a bit older and do great things with that ability, then sort of forget it all and be too old to be useful.

wyldfire 9y ago

> When a fellow researcher asked him about another possible aspect of processor design that might be vulnerable to attack, Horn said, with a brief-but-telling smile: "I’ve been wondering about it but I have not looked into it." Anyone who was at RWC2018 who can tell us what this item was? Presumably it's too technical for bloomberg's readership and not secret.

Macuyiko 9y ago
Probably the comment regarding Trusted Execution Environments. The talk is online: https://www.youtube.com/watch?v=6O8LTwVfTVs https://www.youtube.com/watch?v=6O8LTwVfTVs

gyyfl 9y ago

I thought meltdown and spectre were found simultaneously and independently by multiple groups?

deleted 9y ago

[deleted]

vatotemking 9y ago

In typical hackernews fashion, most of the comment (even the top comment) is someone downplaying someone else's brilliance. Why cant you just be happy for the kid? Some people are just plain better than you. And its OKAY. Most of us here are average, and will probably never see our own success story published like this. Kid has done and contributed so much at a young age. He's clearly way above average, judging from the reaction of his peers in the netsec community. His skills has benefited us all. His achievement should be celebrated, not met with bitterness.

TomMarius 9y ago
He's brilliant; but it's not about the age. I'm in a similar position to him (working on a very senior position in a big enterprise even though I'm in my very early twenties, I'm even younger than him) and I can assure you people like us don't like others pointing out our age. Focus on our achievements, our knowledge and our experience.