22 ms·

Intel Has a Big Problem

780 points by MilnerRoute 9y ago

lower 9y ago
Could it be that Intel is communicating the way it does because they're afraid of lawsuits? I mean, if they admit that their processors are faulty, then they may have to recall basically all their processors.
- gkya 9y ago
  How can that even happen? My laptop has a vulnerable i3 chip, but I'm not giving it or the chip to anybody, I need the computer. And I guess no data centers would "temporarily close" in order to change CPUs (though maybe they can do that gradually).
  - lower 9y ago
    Back in 1994 when the Pentium had the FDIV bug, they offered to replace the chip. Wikipedia says "Although it turned out that only a small fraction of Pentium owners bothered to get their chips replaced, the financial impact on the company was significant."
xtrapolate 9y ago
Meltdown and Spectre have opened up new hacking threats, sparked class actions, and enraged longtime partners. At this point in time, it is known that Intel isn't the only vendor producing hardware susceptible to Meltdown and Spectre, which is another of saying AMD is in the same boat. Given this fact, I'm struggling to understand why Intel is being continuously singled out. Meltdown and Spectre aren't the first, won't be the last. I personally feel that a more interesting discussion should take place: how to prepare/plan-for/deal-with similar issues further down the road. One particular thought that comes to mind is that this industry lacks an effective recall mechanism.
- HugoDaniel 9y ago
  Well they arguably set the road for others to pave. They are a very big player and their (bad) design decisions gradually got adoption among the other players. Is AMD affected by Meltdown ? Do you know something that we don't ?
- jacoblambda 9y ago
  As far as I'm aware, Intel is the only vendor susceptible to Meltdown.
  - johnbellone 9y ago
    There are some ARM CPU that are also vulnerable to Meltdown[0]. https://support.apple.com/en-us/HT208394 https://support.apple.com/en-us/HT208394
  - chapill 9y ago
    https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update A75 is meltdown. Qualcomm Snapdragon 845. Go ahead and skip the next generation of Android flagships. The whole line of them will be based on 845 garbage.
- xigency 9y ago
  Meltdown is an Intel-specific design mistake dating back a decade. It is also the bigger fish. Spectre, while real, has been a gift to Intel to use as a smokescreen in PR and reporting.
  - wsxcde 9y ago
    But that is what it is, a design mistake -- a totally non-obvious design mistake. I believe the number of people who would have looked at Intel's design decisions related to meltdown and thought to themselves this was a credible security holeis very close to zero. I can say this with some confidence because I used to do processor performance modeling for AMD, security verification for Intel and now do research in hardware security verification. This is not a bug until you look at the exploit. I am certain AMD/ARM/RISC-V or whatever other Intel competitor you can think of have similar security bugs in them. It's just a question of whether people will find them. In fact, knowing what I know about AMD and Intel, I'm willing to bet these other companies have more security holes, not less than Intel
013a 9y ago
Intel is a hot mess even without these security disasters. Just look at their product release lifecycle: In years past, they'd get maybe one extra product release off each new arch (tick/tock); for example, Sandy Bridge bore Ivy Bridge and Haswell bore Broadwell. Skylake has born SIX new product lines; Goldmont, Goldmont Plus, Kaby Lake, Kaby Lake Refresh, Coffee Lake, and the upcoming Cannonlake. Their failed 10nm shrink has forced product delays; remember, Cannonlake (the 10nm shrink of Skylake) was supposed to be released in 2016, and its not even out yet. Just at CES this week they said they've shipped mobile Cannonlake CPUs. They have zero presence in mobile. Their best efforts involve competent Y-series processors. Then Apple comes around and, seemingly without even trying, destroys them [1] with a product that's more thermally efficient and, in some ways, more powerful than Intel's best mobile processors, not just their thermally efficient ones. They have little presence in HPC/AI, where Nvidia is slaughtering everyone and its not even close. Its completely inevitable they're going to lose Apple as a customer for consumer products; its just a matter of time. AMD is gaining traction with Zen, and they're moving in the direction enterprise cloud provider want (lots of cores, not much $$). How much longer can Intel keep holding on? Do they have an ace they've been hiding? Will people even trust their ace after Meltdown? [1] https://9to5mac.com/2017/06/14/ipad-pro-versus-macbook-pro-speed-tests/ https://9to5mac.com/2017/06/14/ipad-pro-versus-macbook-pro-s...
- DeepYogurt 9y ago
  Goldmont is the atom line and not related to skylake. Apple has been building cpus for years now and it's unfair to claim that the apple chips blow the intel ones out of the water based on some simple int/fp benchmarks. I agree that they will lose apple in time, but "in time" could be on the order of 10 years.
  - yuhong 9y ago
    That being said, Apple has been waiting for Cannonlake for LPDDR4 support.
  - AdamJacobMuller 9y ago
    10 years isn't that long in a fab-scale company. I would be absolutely shocked if Apple did not already have MacBook-level ARM cores running macOS in their development labs. Just as Apple had OSX running on Intel hardware for years while developing/selling PPC. I think there's a very good chance we see a MacBook form factor laptop running an ARM chip in the next few years. I'd buy one, having a laptop with multi-day battery life would be awesome. I don't need super performance on my MacBook.
kazinator 9y ago
> Part of what makes Meltdown and Spectre so terrifying is that they upend more than a decade of conventional wisdom about information security. The combination of speculative execution, virtual memory, caching and user/supervisor privilege separation isn't ten years old. These flaws upend something like 40 years of conventional wisdom.
- omginternets 9y ago
  I'm confused as to what this conventional wisdom they're alluding to actually is. Would you mind spelling it out?
  - syncsynchalt 9y ago
    Conventional wisdom such as: // it is impossible to read past the end // of the array in this code: if (i >= 0 && i < array.size()) x = array[i];
    - inimino 9y ago
      The conventional wisdom has always been that it is impossible if and only if your hardware is not broken. If the hardware is broken, all bets are off. Nothing in the conventional wisdom has been challenged, except perhaps the complacent assumption that "Intel hardware is unlikely to be broken in ways that invalidate our security".
      - cesarb 9y ago
        Spectre is not just Intel. That "array bounds" example is Spectre variant 1, which affects everyone except in-order processors (older Atom and slower ARM). So far, I haven't read of any hardware mitigation for it (unlike variant 2 or Meltdown aka "variant 3"). The mitigations for variant 1 I've seen are either introducing a speculation barrier on array bounds checks, or faster masking tricks which convert speculated out-of-bounds values into safe values. It won't surprise me at all if conventional wisdom changes to include speculation effects, much like it has changed to include cache effects once memory got slower than the CPU.
can3p 9y ago
A really wish the topics with clickbait title like this were banned on hacker news
neonate 9y ago
In case anyone was confused like I was, trying to find the article text: http://archive.is/ywGYJ http://archive.is/ywGYJ.
VHRanger 9y ago
The main problem with intel is direction and process. Dan Luu pointed out in 2015 [1] that intel chips had serious bugs and, given how intel acted, it was only a manner of time before something like this popped up. What I see happened to Intel is that once they consolidated their monopoly in the late 2000s, they lost the healthy management practices that tend to come from being in a competitive industry. All this talk from upper management about velocity was about trying to find a way to make more money when you've mined out your current niche completely. It ended up instead opening the door for AMD to make a comeback on x86 [1] https://danluu.com/cpu-bugs/ https://danluu.com/cpu-bugs/
- harryh 9y ago
  I think that comparing the types of bugs in Luu's post (which is excellent) and Spectre/Meltdown is a mistake. The former are mistakes caused by insufficient testing. The latter are conceptual problems that are nearly fundamental to modern processor design. No amount of simple testing would have uncovered them.
  - nickpsecurity 9y ago
    Exactly. It's why you need multiple, assurance activities on projects to spot what a single one can't handle. I summarized here [1] those that produced results at various points in CompSci and INFOSEC history. Far as this, the first applications of covert-channel analysis to hardware found cache-based, timing channels in both VAX [2] and Intel CPU's [3]. That the caches leaked secrets meant any number of constructions built on top would leak secrets. So, proper response would be either one cache/core/cpu per security domain or designing a new cache that didn't leak secrets. The former was high-security's fall-back with the latter attempted by many in CompSci using partitioning or masking caches. The first was done in 2005 after Percival's work showing secret leaks. That first attempt on partitioned caches also cited prior work in real-time sector thinking similarly to boost determinism: proving determinism and covert channel prevention were always closely related. There were many designs after that for both partitioning and masking before the Intel hit. So, the root causes of shared, on-chip resources were identified by mid-1990's, demonstrated again by later work like Percivals, being mitigated from that year onward, and ignored by CPU vendors. When I asked in the past, hardware people told me they didn't care about cache security because their sales were strictly tied to customers' benchmarks of performance per dollar and watt. Customers didn't care. Suppliers didn't care. That simple. There were in fact (tiny) segments where customers were buying processors with more robustness or predictability. Those that come to mind were some PowerPC designs from Freescale that aerospace liked, Leon3-FT SPARC that was GPL, some smartcard components, and especially Rockwell-Collins' AAMP7G [5]. Designed with EAL7 methods from 1992, it had mathematical proof of separation at level, triplicated registers for fault-tolerance, ECC memory, and MILSPEC heat tolerance. It's used in guards to separate Top Secret/SCI info from other stuff. So, these are old attacks with mitigations of various costs that were ignored for profit maximization by the big companies and performance maximization by most consumers/businesses who didn't buy security in general. Both old and new techniques were effective at assessing leaks and mitigations, though. They could've been used at any time, were by CompSci, were by security-critical suppliers (esp Rockwell), and even more techniques exist now for analysis [6]. Intel et al will just patch up until next attack since they and the market haven't changed. ;) [1] https://pastebin.com/uyNfvqcp https://pastebin.com/uyNfvqcp [2] https://www.google.ch/patents/US5574912 https://www.google.ch/patents/US5574912 (Note: Using the patent filing since the 1992 work is paywalled. It's the same person filing what they discovered on VAX VMM project.) [3] https://pdfs.semanticscholar.org/2209/42809262c17b6631c0f6536c91aaf7756857.pdf https://pdfs.semanticscholar.org/2209/42809262c17b6631c0f653... [4] https://eprint.iacr.org/2005/280.pdf https://eprint.iacr.org/2005/280.pdf [5] http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf [6] https://pastebin.com/ajqxDJ3J https://pastebin.com/ajqxDJ3J
sdhgaiojfsa 9y ago
I'm skeptical that Intel really has that much of a problem, and the investors in the stock market seem to agree. Intel only has a problem if alternatives come to be seen as economically viable. And right now it doesn't seem like there's any particular danger of this happening. Pundits want to say that there's a huge thing here, because pundits don't optimize for the truth. They optimize for clicks. So you really need to be careful looking to their writing for the truth.
- abritinthebay 9y ago
  Using the current stock market reaction as a bellwether for anything but short term (1-6 months) outlook is a bit silly. In the longer term (1-3 years) Intel has a very large problem. Especially as they are being eaten alive in non-desktop class cpus right now. These issues may not be a knockout punch, or even have them on the ropes, but it made them stumble and they look vulnerable.
- gonational 9y ago
  How do you factor into your thesis the possibility of a multinational class-action lawsuit?
- jolan 9y ago
  It's not even close to being over -- https://skyfallattack.com/ https://skyfallattack.com/
  - bonzini 9y ago
    There seems to be consensus that it's a hoax.
    - jolan 9y ago
      Is there an embargo? Is it a silly play on the James Bond reference that Spectre represented? Either way pretty funny since you can't know for sure after this fiasco. Botched micro code updates, Intel engineers arguing with each other on the linux kernel mailing list, etc. Intel's best and brightest have had 6+ months to work on proper mitigations in secret and this is the result. https://marc.info/?l=linux-kernel&m=151559244214217&w=2 https://marc.info/?l=linux-kernel&m=151559244214217&w=2 https://marc.info/?l=linux-kernel&m=151559367514704&w=2 https://marc.info/?l=linux-kernel&m=151559367514704&w=2
josh2600 9y ago
Maybe I’m missing something... this article says every smartphone is exposed... is that actually the case? Which smartphones use Intel chips? Maybe they’re referring to the fact some of these bugs are present on other chipsets but that seems weird in an Intel article. Am I missing something?
- tylerscott 9y ago
  I was also confused by that. The author goes on to state near the end of the article that Intel is not in the smart phone space. A little more clarity around which issues are present on smart phones and how that directly relates to Intel would be helpful.
- dragontamer 9y ago
  Spectre affects all advanced chips with out-of-order execution. But Spectre cannot break kernel memory. Its more of a "new class" of bug, similar to how "Buffer Overflows" don't describe a particular attack, but a methodology that hackers will use to exploit new bugs. Spectre affects virtually every high-performance computer in the world. Smartphones, SPARC, PowerPC, Intel, AMD, ARM. All of these designs use out-of-order execution, and in theory, a rogue Javascript would be able to read the rest of process memory if a programmer isn't careful about how things work. Meltdown took it one step further: and showed that code could read Kernel memory. That was an Intel-specific mistake.
  - titzer 9y ago
    > Spectre affects all advanced chips with out-of-order execution. It's not out-of-order execution, it's speculative execution (all forms of branch prediction) plus the ability to affect the cache state during speculative execution.
    - dragontamer 9y ago
      I'd be surprised if there was an out-of-order CPU that didn't do speculative executions. I mean, a major benefit of OOE is to fill up the pipelines / execution units, and speculative execution is a very "obvious" way to do that.
111_1_111 9y ago
This author packed so many inaccuracies into one article that I can barely remember them all. Journalism is dead. If Intel's chips are now 30% slower, that means the market now needs somewhere between 0 and 30% more chips. I don't think their revenue will be affected negatively at all.
waynecochran 9y ago
It's almost as if the author didn't watch the Vegas Keynote. It was the very first thing that was addressed when the CEO spoke.
- foobarbazetc 9y ago
  You need to put a disclaimer at the end of your post.
  - JdeBP 9y ago
    Only if xe confuses disclaimer for disclosure, of course. (-:
- danieldk 9y ago
  Since this concerns your employer, it would be nice to state your affiliation. Also, the initial press release was worded such that all CPUs had the same problems. This is only true for Spectre, Meltdown is specific to Intel CPUs and some other CPUs (such as recent Apple CPUs), but it is definitely not a general bug. Then there were benchmarks one or two days ago that were seemingly intentionally misleading. E.g., they included typical number crunching benchmarks, while Meltdown mitigation only concerns system calls and Spectre mitigations are still very limited in software. Rather than communicating this clearly, it was a big cover-up screaming 'see, nothing happened'. The problem is that after the ME and now this debacle, very few technical people still trust Intel. There may be no alternatives for e.g. HPC, but if Intel doesn't clean up this mess, people might vote with their wallets as soon as they can.
make3 9y ago
It's literally the first thing he mentioned in the speech, though I admit he likely went too fast on the subject and was not convincing or reassuring at all
saalweachter 9y ago
Frankly I think this says something about the security of modern OS's that two of the most recent exploits have been hardware based.
- yborg 9y ago
  https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux I wouldn't say that the security of the "modern OS" is a solved problem. The Meltdown/Spectre issues happen to be broad-based and heavily publicized, I don't think you can draw any more general conclusions from them. In general, as long as human beings are designing and implementing information processing systems, there will be bugs. Once AI systems are building them, there will also be bugs, but no human being will be able to understand them.
coldtea 9y ago
Aside: as if Moore's Law (in the form often casually understood, about processing speed/power, not transistor count) wasn't screwed enough as it is.
- djsumdog 9y ago
  We've been out of the Moore's Law window for a while. Processing power no longer really increases in a linear fashion. Instead, manufactures increase throughput by smaller improvements in the processor and by squeezing in more cores per chip. This also means our tasks/programs are changing to utilize more multi-threading capabilities. The idea of what is high performance has really changed.
  - xigency 9y ago
    Moore's law works on transistor density, so adding cores to a chip can be a continuation of it. The barriers to faster single core performance are power/heat in increasing clock speed and diminishing returns in superscalar architecture. Moore's law is still alive, it's just dwindling now.
    - alkonaut 9y ago
      > Moore's law works on transistor density, I thought it was transistor count in IC's? If we assume that for state of the art chips the area is more or less fixed (by speed of light, manufacturing constraints, thermal constraints etc) then there is no difference between "transistor density" and "transistor count" - but is that the case? Is there no margin for die growth (Disregarding yield/cost - considering only physical constraints)?
chiefalchemist 9y ago
> "Krzanich sold $24 million in company shares. Intel says the stock sale was part of a plan that had been in place before anyone there knew about Meltdown or Spectre..." Certainly, if there's proof, they would, under the circumstance, provide it. Without out that proof the sale of this many shares in that time window tells us all we need to know. Off topic: How has Intel become so dominate, and not been pursued as a monopoly? Legal issues aside, how did so many big customer allow all their collective eggs to be in a single basket? It seems to me, at some point, some of the responsibility needs to be shared by other industry titans.
- mr_toad 9y ago
  Given the cost of designing a CPU and setting up manufacturing capacity you could argue that they’re a natural monopoly. At the least there is a significant hurdle to entering the market, which intel can use to its advantage.
  - chiefalchemist 9y ago
    Yes. But still a monopoly. And now that such chips are global the whole world's eggs are in a single basket. What could go wrong? Wait! I think they just answered that.
40acres 9y ago
I wonder which, if any, government organizaations knew about this. Did the DoD know? Russia? China? I remember reading about a "cyperweapon" the US government was using to cause North Korean missile tests to fail before launch. Could attacks like this be possible through meltdown?
yeasayer 9y ago
I think Intel might get away with it. Last 5 years they were slacking off, because economically there is no reason to go over the usual 10-15% yearly performance bump. But actually they were accumulating aces up their sleeves. Again, no reason to show your hand, if you don't have to. But the time has come. Right now Intel has 3 major problems: 1) Meltdown/Spectre situation 2) AMD is awoken from sleep with surprisingly good Ryzen lineup 3) Apple craves new powerful CPUs to satisfy unhappy MacBook Pro customers Intel can fix all of this with one sweep. Just by releasing a brand new CPU that will surprise everyone. Of course with hardware Meltdown/Spectre fix. They were holding off, but it's time to drop all these hidden aces on the table. And I believe it's gonna happen. Not right now with Cannon Lake, but with the one after - Ice Lake on 10nm transistors, by the end of 2018. It's going to be even bigger than NVIDIA's GTX 1080 success.
- titzer 9y ago
  If you think they can redesign their cache geometry, indirect branch predictors, and return stack buffers in the matter of a few months and then tape out new processors by the end of the year, you're nuts. It's gonna take 3 years minimum until even the easiest of those things is resolved and silicon hits the street, even if Intel begrudgingly admits they need to do this.
- yorby 9y ago
  They had an ace up their sleeve to fix those security issues? If that is true, they should get ready for the lawsuits I guess...
- fyi1183 9y ago
  Doubtful. You don't just develop a new processor over night, and if they truly had all these aces up their sleeves, they would have dropped them already in response to Zen last year. Intel's process advantage is shrinking. They're struggling like everybody else because the physics is getting harder and harder. Apart from the fact that it would have been nice to get easy process shrinking forever, this is good news for almost everybody: it means competition for them is getting tougher.
  - 9y ago
cybervegan 9y ago
The holes in this article belie an fundamental misunderstanding of how the flaw works, and, how computers in general work. I agree with the general premise of the article, but if they don't understand it, they should avoid trying to explain it.
rdiddly 9y ago
I'm confused, did Vegas change from a place that's all about a show, to one where one expects to find seriousness, honesty, contrition? In a keynote?
jwilk 9y ago
> Starting in the mid-2000s, Intel added a layer of security within its chips and began encouraging developers to store users’ most sensitive information in the walled-off area rather than in regular software memory. What "layer of security" and "area" they are talking about?
- nootropicat 9y ago
  It's a very confusing attempt to explain the difference between kernel and user memory space. I don't think article's authors understand it.
  - jwilk 9y ago
    Yeah, but that'd be 1980s, not 2000s. :-\
    - capitalsigma 9y ago
      I think they're talking about going from an unprotected to a protected memory model. The windows 9x line was unprotected (ending with "Windows ME" circa 2000) and NT was protected. The first consumer NT was XP in, what, 2002? That lines up with their "early 2000's" comment. Why they're deciding to credit Intel with protected memory models is beyond me, though. Maybe they thought they needed to give some credit to Intel for something to make the article seem more balanced.
    - JdeBP 9y ago
      Yes, the article got both the purpose and the dates quite wrong.
- foobarbazetc 9y ago
  I think they’re talking about TPM.
- drxzcl 9y ago
  I’m guessing SGX.
HugoDaniel 9y ago
They are too big to fail. It is us, the users, who have a problem: we have to put up with their mess and shady tactics.
5ilv3r 9y ago
Lots of Intel apologists in this thread. I for one am excited by the idea of healthy competition in the processor market.
HenryBemis 9y ago
To quote from the "Quest for the Holy Grail" and the scene with the Black Knight (guarding the 'bridge'): "'Tis but a scratch". Intel doesn't care. They will downplay it, misinform and misdirect till the cows go home. No point beating a dead horse. The only think Intel (and most other corporations) unerstand is to stop buying their products. This is the only language they 'speak'.
simik 9y ago
> Krzanich showed off a full-size pilotless helicopter Wait... what?
- elihu 9y ago
  That was a Volocopter. I think it uses some Intel parts or technology, but I don't remember what exactly.
Nokinside 9y ago
Intel still has the advantages that allow them to screw up and survive. 1. Process knowledge and manufacturing capacity. You can buy from others only as much as they have manufacturing capacity. Only real threat to Intel comes from combined volume of GlobalFoundries, TSMC, Samsung and UMC. Apple, NVIDIA, AMD, ARM and Qualcomm can get past Intel only trough these companies. 2. Profit margins. Intel makes 60 percent profit margins, AMD struggles from decade to decade. That's not a coincident. It's the direct result of pricing decisions by Intel. Whenever AMD gets ahead Intel in uP technology, Intel has always the option of cutting profit margins and prevent AMD from gaining more market share.
- Tharkun 9y ago
  The odd bit of anti-competitive behaviour (and billion-dollar lawsuits that come with it) is also something of an advantage...if an unfair one.
frankharv 9y ago
The article has some false information "Intel says it’s already provided software fixes for 90 percent of its chips" This is a falsehood. They MCU updates only cover IvyBridge and newer CPU's. Check the dates on the MCU files.
Animats 9y ago
Bloomberg says Intel has a big problem. The Economist says Intel has a big problem. Three class actions already filed against Intel. Intel has a big problem. They're probably going to have to replace a lot of CPUs.
- rphlx 9y ago
  May not be a winnable argument on HN (where the consensus seems to be that this is nearly-100% Intel's fault), but I think a significant fraction of the blame properly belongs on their customers, particularly their multi-tenant public cloud customers, for assuming a level of HW thread and guest isolation that has never actually existed. These huge-scale customers did not do proper security due dil on the silicon they were buying and made assumptions that were never, strictly speaking, guaranteed by Intel, and in some cases were explicitly documented as not guaranteed within the Intel optimization manuals.
  - bsder 9y ago
    > These huge-scale customers did not do proper security due dil on the silicon they were buying and made assumptions that were never, strictly speaking, guaranteed by Intel, and in some cases were explicitly documented as not guaranteed within the Intel optimization manuals. But the commodity hardware is SOOOOOO much cheaper, you know? Everything about Intel was always about "good enough" from since probably ... 1982? And "good enough" security in hardware was always "nobody cares". IBM, certainly, was screaming about the level of insecurity in commodity hardware and software forever. DEC similarly. But commodity hardware is SOOOO much cheaper. No one. And I mean NO ONE was every going to give up even 10% on performance or cost in order to be even slightly more secure. At any level of the stack. Intel, Microsoft, Google ... all are guilty of this up until probably this year. Anybody who suggested that would have gotten laughed at and/or fired. The market spoke--and security became an afterthought. Sadly, this is STILL true. While there is much gnashing of teeth about Intel, everybody's implementation of security is far worse. The thing that is biting Intel is that the monoculture means that it is a universal and scalable tool as opposed to at the software level where each individual company has to be compromised in a slightly different way. It's only been since everybody is putting everything in the cloud that people now care about actual absolute values of security. The problem is that all of the hardware solutions to these bugs cost RAM somewhere. And RAM is now the gating factor of cost and performance on most chips. RAM fell off the Moore's Law curve back about 32-22nm and isn't coming back. So, the performance hit to mitigate this is real. No one was going to be the first to fix this EVEN IF THEY KNEW AND CARED. Everybody learned from painful business experience that the first guy gets all the arrows and the second guy gets all the profits. So, everybody was going to wait until they were the second guy--which was only going to happen when something bit everybody.
exabrial 9y ago
Well written article! Definitely a few waited in there that explain the problem in plain English
exabrial 9y ago
x86 is a problem... Itanium was supposed to be the life boat but it came too soon.
- pmlnr 9y ago
  Alpha? SPARC?
bigbugbag 9y ago
> The company makes about 90 percent of the world’s computer processors and 99 percent of the server chips in the data centers that effectively run the internet. Since when do datacenter servers run the internet ? The journalist seem to not understand the role of routers and network equipment to connect those servers. You could add AS to the mix but the datacenter servers are connected to the internet not running it. The internet would still work if we removed all those servers, it would work as intended even.
anonu 9y ago
From the article: >> Starting in the mid-2000s, Intel added a layer of security within its chips and began encouraging developers to store users’ most sensitive information in the walled-off area rather than in regular software memory. Can anyone explain what the author is referring to as "walled-off" area? L1, L2 Cache?
- taspeotis 9y ago
  Trusted Platform Module.
- JdeBP 9y ago
  This is a botched attempt to explain the user/supervisor mode distinction, that gets the dates and the purpose wrong.
MechEStudent 9y ago
Paywalled?
StillBored 9y ago
I don't know why people are so focused on intel here. Its not like other processors aren't affected, even ARM's latest core (A75 https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update) is susceptible to meltdown. I suspect that if they had been building aggressive OoO CPU's with deep ROB rather than focusing on perf/W there would be a lot more cores on that list. Similarly IBM's high end POWER processors are also vulnerable (although they don't break it down as nicely as ARM https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/ https://www.ibm.com/blogs/psirt/potential-impact-processors-...) So, everyone is like Intel is so bad, when they just happen to be the one that people are running the most untrused code on. Let me quote IBM "This vulnerability doesn’t allow an external unauthorized party to gain access to a machine, but it could allow a party that has access to the system to access unauthorized data." People on this board are upset, because after spending the last decade+, making promises about how secure "cloud computing" is, once again the naysayers were proven correct. This time the flaw is so fundamental that in order to fix it you have the OS vendors making changes the destroy system performance for most applications that are I/O or just syscall intensive. This likely won't be the last time either if history is to be believed. But javascript you cry, again I'm going to say that you shouldn't be running random code from random people on the internet. I'm not a big fan of intel, but in a way I applaud them for pushing back against what I view as the crazy extent people go to in order to allow native code execution from untrused sources. I would much prefer this change be isolated to hypervisors, and have chrome/ff/etc detune their JIT's a bit to keep people from running cache timing attacks. So, I likely will be turning the kpti off on most of my machines the same way I run them with the iommu's disabled because I'm not running VM's with untrused code. (BTW, once the dust settles, i'm guessing a pretty large number of other aggressive OoO processors are vulnerable as well (old Alpha/PA-RISC/SPARC/etc)).
guhcampos 9y ago
The article is ridiculously biased. It makes absolutely no sense to talk about "moving away from Intel" to anything else because of Spectre. Every modern CPU is vulnerable to this type of attack. The "fix" involves turning off branch prediction, and that will slow down any CPU, from any vendor, of any platform. CPUs which are not affected generally do not take advantage of branch prediction anyways, and that generally makes them less powerful. Why the hell would anyone move from an underpowered Intel chip, spending copious amounts of money for such migration (you don't just change your CPU), and replace it with an even less powerful chilp? And Meltdown... Well, that's just the FIRST platform specific vulnerability found using the Spectre strategy. There will be more, hell, there are probably more already, just not published yet. No brand is safe, this is not an Intel bug, it's a bug in Computer Science itself. If anyone wants to profit from it, they'll need more than paid Bloomberg posts, they'll need to rethink how we build processors.
deleted 9y ago
[deleted]
Pica_soO 9y ago
Here we are at the high point of our historic exhibition of the horrors of the 22 century. The first public occurance of public/private law. A company which had a major flaw in its products, secretly negotiated a silent phase out of its flawed products for its bigger customers creating a private settlement, while avoiding the public courts by declaring the error trivial. This company was too entrenched to fail, as in every big actor agreed upon that seeing the company go under and half of all legacy software rewritten to accommodate new hardware, was not in the interest of a "informed" public. Liberal fanatics of course, had no such distributed hostage effect in there market-models, and where under the illusion that the Anorexia state they created, was still too much of a influence, while in truth the upholder of citizen rights was not even present anymore at the negotiation table. This catastrophe would later on lead to a heretic movement among the fanatics, that viewed hardware dependence in legacy not as something ugly but inevitable, but something threatening to their deity, the one free market. Please follow me into the next exhibition hall, where we will see the reintroduction of generational slavery by debt for the underclass. Please watch your steps, some of the tiles on the floor are in slight disrepair-
danpalmer 9y ago
I think Spectre and Meltdown are a fantastic opportunity to rediversify the CPU market, and I don’t think it could have come at a better time. - AMD has just had a great release with Ryzen, showing they can compete on a price/performance basis. - Apple is moving core OS functionality on its newest desktops/laptops on to Apple designed ARM chips. - Mobile platforms are getting bigger, especially with things like ChromeOS that could be (are being?) easily run on ARM based hardware. - Open Power has come a long way and could be poised to take some of the server market for customers who want more control than they got with Intel. I’m excited for this. Obviously the vulns are an issue that needs to be solved, but we could get some real competition in terms of manufacturers, and even in terms of architecture. The industry will take some time to readjust to compiling for/running on multiple architectures, which I think much of the industry hasn’t needed to deal with for a while. The result though will be a market where customers can choose an architecture that makes sense for their use case, and can choose from a range of good options. (I realise other chips are vulnerable, not just Intel, but the publicity has been Intel focused and I don’t think the technicalities of it matter too much)
alkonaut 9y ago
Long term Intel will have to "fix" these issues - but what about short term? Even if they won't have to replace sold processors (which is not likely), what about CPU's in their current pipeline? If properly fixed chips are 3 years out, what are they doing for 2018/19? Are they just going to keep making small tweaks to their current chips, and sell them with the known flaws?

780 points by MilnerRoute 9y ago

Could it be that Intel is communicating the way it does because they're afraid of lawsuits? I mean, if they admit that their processors are faulty, then they may have to recall basically all their processors.

gkya 9y ago
How can that even happen? My laptop has a vulnerable i3 chip, but I'm not giving it or the chip to anybody, I need the computer. And I guess no data centers would "temporarily close" in order to change CPUs (though maybe they can do that gradually).
- lower 9y ago
  Back in 1994 when the Pentium had the FDIV bug, they offered to replace the chip. Wikipedia says "Although it turned out that only a small fraction of Pentium owners bothered to get their chips replaced, the financial impact on the company was significant."

xtrapolate 9y ago

Meltdown and Spectre have opened up new hacking threats, sparked class actions, and enraged longtime partners. At this point in time, it is known that Intel isn't the only vendor producing hardware susceptible to Meltdown and Spectre, which is another of saying AMD is in the same boat. Given this fact, I'm struggling to understand why Intel is being continuously singled out. Meltdown and Spectre aren't the first, won't be the last. I personally feel that a more interesting discussion should take place: how to prepare/plan-for/deal-with similar issues further down the road. One particular thought that comes to mind is that this industry lacks an effective recall mechanism.

HugoDaniel 9y ago
Well they arguably set the road for others to pave. They are a very big player and their (bad) design decisions gradually got adoption among the other players. Is AMD affected by Meltdown ? Do you know something that we don't ?
jacoblambda 9y ago
As far as I'm aware, Intel is the only vendor susceptible to Meltdown.
- johnbellone 9y ago
  There are some ARM CPU that are also vulnerable to Meltdown[0]. https://support.apple.com/en-us/HT208394 https://support.apple.com/en-us/HT208394
- chapill 9y ago
  https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update A75 is meltdown. Qualcomm Snapdragon 845. Go ahead and skip the next generation of Android flagships. The whole line of them will be based on 845 garbage.
xigency 9y ago
Meltdown is an Intel-specific design mistake dating back a decade. It is also the bigger fish. Spectre, while real, has been a gift to Intel to use as a smokescreen in PR and reporting.
- wsxcde 9y ago
  But that is what it is, a design mistake -- a totally non-obvious design mistake. I believe the number of people who would have looked at Intel's design decisions related to meltdown and thought to themselves this was a credible security holeis very close to zero. I can say this with some confidence because I used to do processor performance modeling for AMD, security verification for Intel and now do research in hardware security verification. This is not a bug until you look at the exploit. I am certain AMD/ARM/RISC-V or whatever other Intel competitor you can think of have similar security bugs in them. It's just a question of whether people will find them. In fact, knowing what I know about AMD and Intel, I'm willing to bet these other companies have more security holes, not less than Intel

013a 9y ago

Intel is a hot mess even without these security disasters. Just look at their product release lifecycle: In years past, they'd get maybe one extra product release off each new arch (tick/tock); for example, Sandy Bridge bore Ivy Bridge and Haswell bore Broadwell. Skylake has born SIX new product lines; Goldmont, Goldmont Plus, Kaby Lake, Kaby Lake Refresh, Coffee Lake, and the upcoming Cannonlake. Their failed 10nm shrink has forced product delays; remember, Cannonlake (the 10nm shrink of Skylake) was supposed to be released in 2016, and its not even out yet. Just at CES this week they said they've shipped mobile Cannonlake CPUs. They have zero presence in mobile. Their best efforts involve competent Y-series processors. Then Apple comes around and, seemingly without even trying, destroys them [1] with a product that's more thermally efficient and, in some ways, more powerful than Intel's best mobile processors, not just their thermally efficient ones. They have little presence in HPC/AI, where Nvidia is slaughtering everyone and its not even close. Its completely inevitable they're going to lose Apple as a customer for consumer products; its just a matter of time. AMD is gaining traction with Zen, and they're moving in the direction enterprise cloud provider want (lots of cores, not much $$). How much longer can Intel keep holding on? Do they have an ace they've been hiding? Will people even trust their ace after Meltdown? [1] https://9to5mac.com/2017/06/14/ipad-pro-versus-macbook-pro-speed-tests/ https://9to5mac.com/2017/06/14/ipad-pro-versus-macbook-pro-s...

DeepYogurt 9y ago
Goldmont is the atom line and not related to skylake. Apple has been building cpus for years now and it's unfair to claim that the apple chips blow the intel ones out of the water based on some simple int/fp benchmarks. I agree that they will lose apple in time, but "in time" could be on the order of 10 years.
- yuhong 9y ago
  That being said, Apple has been waiting for Cannonlake for LPDDR4 support.
- AdamJacobMuller 9y ago
  10 years isn't that long in a fab-scale company. I would be absolutely shocked if Apple did not already have MacBook-level ARM cores running macOS in their development labs. Just as Apple had OSX running on Intel hardware for years while developing/selling PPC. I think there's a very good chance we see a MacBook form factor laptop running an ARM chip in the next few years. I'd buy one, having a laptop with multi-day battery life would be awesome. I don't need super performance on my MacBook.

kazinator 9y ago

> Part of what makes Meltdown and Spectre so terrifying is that they upend more than a decade of conventional wisdom about information security. The combination of speculative execution, virtual memory, caching and user/supervisor privilege separation isn't ten years old. These flaws upend something like 40 years of conventional wisdom.

omginternets 9y ago
I'm confused as to what this conventional wisdom they're alluding to actually is. Would you mind spelling it out?
- syncsynchalt 9y ago
  Conventional wisdom such as: // it is impossible to read past the end // of the array in this code: if (i >= 0 && i < array.size()) x = array[i];
  - inimino 9y ago
    The conventional wisdom has always been that it is impossible if and only if your hardware is not broken. If the hardware is broken, all bets are off. Nothing in the conventional wisdom has been challenged, except perhaps the complacent assumption that "Intel hardware is unlikely to be broken in ways that invalidate our security".
    - cesarb 9y ago
      Spectre is not just Intel. That "array bounds" example is Spectre variant 1, which affects everyone except in-order processors (older Atom and slower ARM). So far, I haven't read of any hardware mitigation for it (unlike variant 2 or Meltdown aka "variant 3"). The mitigations for variant 1 I've seen are either introducing a speculation barrier on array bounds checks, or faster masking tricks which convert speculated out-of-bounds values into safe values. It won't surprise me at all if conventional wisdom changes to include speculation effects, much like it has changed to include cache effects once memory got slower than the CPU.

can3p 9y ago

A really wish the topics with clickbait title like this were banned on hacker news

neonate 9y ago

In case anyone was confused like I was, trying to find the article text: http://archive.is/ywGYJ http://archive.is/ywGYJ.

VHRanger 9y ago

The main problem with intel is direction and process. Dan Luu pointed out in 2015 [1] that intel chips had serious bugs and, given how intel acted, it was only a manner of time before something like this popped up. What I see happened to Intel is that once they consolidated their monopoly in the late 2000s, they lost the healthy management practices that tend to come from being in a competitive industry. All this talk from upper management about velocity was about trying to find a way to make more money when you've mined out your current niche completely. It ended up instead opening the door for AMD to make a comeback on x86 [1] https://danluu.com/cpu-bugs/ https://danluu.com/cpu-bugs/

harryh 9y ago
I think that comparing the types of bugs in Luu's post (which is excellent) and Spectre/Meltdown is a mistake. The former are mistakes caused by insufficient testing. The latter are conceptual problems that are nearly fundamental to modern processor design. No amount of simple testing would have uncovered them.
- nickpsecurity 9y ago
  Exactly. It's why you need multiple, assurance activities on projects to spot what a single one can't handle. I summarized here [1] those that produced results at various points in CompSci and INFOSEC history. Far as this, the first applications of covert-channel analysis to hardware found cache-based, timing channels in both VAX [2] and Intel CPU's [3]. That the caches leaked secrets meant any number of constructions built on top would leak secrets. So, proper response would be either one cache/core/cpu per security domain or designing a new cache that didn't leak secrets. The former was high-security's fall-back with the latter attempted by many in CompSci using partitioning or masking caches. The first was done in 2005 after Percival's work showing secret leaks. That first attempt on partitioned caches also cited prior work in real-time sector thinking similarly to boost determinism: proving determinism and covert channel prevention were always closely related. There were many designs after that for both partitioning and masking before the Intel hit. So, the root causes of shared, on-chip resources were identified by mid-1990's, demonstrated again by later work like Percivals, being mitigated from that year onward, and ignored by CPU vendors. When I asked in the past, hardware people told me they didn't care about cache security because their sales were strictly tied to customers' benchmarks of performance per dollar and watt. Customers didn't care. Suppliers didn't care. That simple. There were in fact (tiny) segments where customers were buying processors with more robustness or predictability. Those that come to mind were some PowerPC designs from Freescale that aerospace liked, Leon3-FT SPARC that was GPL, some smartcard components, and especially Rockwell-Collins' AAMP7G [5]. Designed with EAL7 methods from 1992, it had mathematical proof of separation at level, triplicated registers for fault-tolerance, ECC memory, and MILSPEC heat tolerance. It's used in guards to separate Top Secret/SCI info from other stuff. So, these are old attacks with mitigations of various costs that were ignored for profit maximization by the big companies and performance maximization by most consumers/businesses who didn't buy security in general. Both old and new techniques were effective at assessing leaks and mitigations, though. They could've been used at any time, were by CompSci, were by security-critical suppliers (esp Rockwell), and even more techniques exist now for analysis [6]. Intel et al will just patch up until next attack since they and the market haven't changed. ;) [1] https://pastebin.com/uyNfvqcp https://pastebin.com/uyNfvqcp [2] https://www.google.ch/patents/US5574912 https://www.google.ch/patents/US5574912 (Note: Using the patent filing since the 1992 work is paywalled. It's the same person filing what they discovered on VAX VMM project.) [3] https://pdfs.semanticscholar.org/2209/42809262c17b6631c0f6536c91aaf7756857.pdf https://pdfs.semanticscholar.org/2209/42809262c17b6631c0f653... [4] https://eprint.iacr.org/2005/280.pdf https://eprint.iacr.org/2005/280.pdf [5] http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf [6] https://pastebin.com/ajqxDJ3J https://pastebin.com/ajqxDJ3J

sdhgaiojfsa 9y ago

I'm skeptical that Intel really has that much of a problem, and the investors in the stock market seem to agree. Intel only has a problem if alternatives come to be seen as economically viable. And right now it doesn't seem like there's any particular danger of this happening. Pundits want to say that there's a huge thing here, because pundits don't optimize for the truth. They optimize for clicks. So you really need to be careful looking to their writing for the truth.

abritinthebay 9y ago
Using the current stock market reaction as a bellwether for anything but short term (1-6 months) outlook is a bit silly. In the longer term (1-3 years) Intel has a very large problem. Especially as they are being eaten alive in non-desktop class cpus right now. These issues may not be a knockout punch, or even have them on the ropes, but it made them stumble and they look vulnerable.
gonational 9y ago
How do you factor into your thesis the possibility of a multinational class-action lawsuit?
jolan 9y ago
It's not even close to being over -- https://skyfallattack.com/ https://skyfallattack.com/
- bonzini 9y ago
  There seems to be consensus that it's a hoax.
  - jolan 9y ago
    Is there an embargo? Is it a silly play on the James Bond reference that Spectre represented? Either way pretty funny since you can't know for sure after this fiasco. Botched micro code updates, Intel engineers arguing with each other on the linux kernel mailing list, etc. Intel's best and brightest have had 6+ months to work on proper mitigations in secret and this is the result. https://marc.info/?l=linux-kernel&m=151559244214217&w=2 https://marc.info/?l=linux-kernel&m=151559244214217&w=2 https://marc.info/?l=linux-kernel&m=151559367514704&w=2 https://marc.info/?l=linux-kernel&m=151559367514704&w=2

josh2600 9y ago

Maybe I’m missing something... this article says every smartphone is exposed... is that actually the case? Which smartphones use Intel chips? Maybe they’re referring to the fact some of these bugs are present on other chipsets but that seems weird in an Intel article. Am I missing something?

tylerscott 9y ago
I was also confused by that. The author goes on to state near the end of the article that Intel is not in the smart phone space. A little more clarity around which issues are present on smart phones and how that directly relates to Intel would be helpful.
dragontamer 9y ago
Spectre affects all advanced chips with out-of-order execution. But Spectre cannot break kernel memory. Its more of a "new class" of bug, similar to how "Buffer Overflows" don't describe a particular attack, but a methodology that hackers will use to exploit new bugs. Spectre affects virtually every high-performance computer in the world. Smartphones, SPARC, PowerPC, Intel, AMD, ARM. All of these designs use out-of-order execution, and in theory, a rogue Javascript would be able to read the rest of process memory if a programmer isn't careful about how things work. Meltdown took it one step further: and showed that code could read Kernel memory. That was an Intel-specific mistake.
- titzer 9y ago
  > Spectre affects all advanced chips with out-of-order execution. It's not out-of-order execution, it's speculative execution (all forms of branch prediction) plus the ability to affect the cache state during speculative execution.
  - dragontamer 9y ago
    I'd be surprised if there was an out-of-order CPU that didn't do speculative executions. I mean, a major benefit of OOE is to fill up the pipelines / execution units, and speculative execution is a very "obvious" way to do that.

111_1_111 9y ago

This author packed so many inaccuracies into one article that I can barely remember them all. Journalism is dead. If Intel's chips are now 30% slower, that means the market now needs somewhere between 0 and 30% more chips. I don't think their revenue will be affected negatively at all.

waynecochran 9y ago

It's almost as if the author didn't watch the Vegas Keynote. It was the very first thing that was addressed when the CEO spoke.

foobarbazetc 9y ago
You need to put a disclaimer at the end of your post.
- JdeBP 9y ago
  Only if xe confuses disclaimer for disclosure, of course. (-:
danieldk 9y ago
Since this concerns your employer, it would be nice to state your affiliation. Also, the initial press release was worded such that all CPUs had the same problems. This is only true for Spectre, Meltdown is specific to Intel CPUs and some other CPUs (such as recent Apple CPUs), but it is definitely not a general bug. Then there were benchmarks one or two days ago that were seemingly intentionally misleading. E.g., they included typical number crunching benchmarks, while Meltdown mitigation only concerns system calls and Spectre mitigations are still very limited in software. Rather than communicating this clearly, it was a big cover-up screaming 'see, nothing happened'. The problem is that after the ME and now this debacle, very few technical people still trust Intel. There may be no alternatives for e.g. HPC, but if Intel doesn't clean up this mess, people might vote with their wallets as soon as they can.

make3 9y ago

It's literally the first thing he mentioned in the speech, though I admit he likely went too fast on the subject and was not convincing or reassuring at all

saalweachter 9y ago

Frankly I think this says something about the security of modern OS's that two of the most recent exploits have been hardware based.

yborg 9y ago
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux I wouldn't say that the security of the "modern OS" is a solved problem. The Meltdown/Spectre issues happen to be broad-based and heavily publicized, I don't think you can draw any more general conclusions from them. In general, as long as human beings are designing and implementing information processing systems, there will be bugs. Once AI systems are building them, there will also be bugs, but no human being will be able to understand them.

coldtea 9y ago

Aside: as if Moore's Law (in the form often casually understood, about processing speed/power, not transistor count) wasn't screwed enough as it is.

djsumdog 9y ago
We've been out of the Moore's Law window for a while. Processing power no longer really increases in a linear fashion. Instead, manufactures increase throughput by smaller improvements in the processor and by squeezing in more cores per chip. This also means our tasks/programs are changing to utilize more multi-threading capabilities. The idea of what is high performance has really changed.
- xigency 9y ago
  Moore's law works on transistor density, so adding cores to a chip can be a continuation of it. The barriers to faster single core performance are power/heat in increasing clock speed and diminishing returns in superscalar architecture. Moore's law is still alive, it's just dwindling now.
  - alkonaut 9y ago
    > Moore's law works on transistor density, I thought it was transistor count in IC's? If we assume that for state of the art chips the area is more or less fixed (by speed of light, manufacturing constraints, thermal constraints etc) then there is no difference between "transistor density" and "transistor count" - but is that the case? Is there no margin for die growth (Disregarding yield/cost - considering only physical constraints)?

chiefalchemist 9y ago

> "Krzanich sold $24 million in company shares. Intel says the stock sale was part of a plan that had been in place before anyone there knew about Meltdown or Spectre..." Certainly, if there's proof, they would, under the circumstance, provide it. Without out that proof the sale of this many shares in that time window tells us all we need to know. Off topic: How has Intel become so dominate, and not been pursued as a monopoly? Legal issues aside, how did so many big customer allow all their collective eggs to be in a single basket? It seems to me, at some point, some of the responsibility needs to be shared by other industry titans.

mr_toad 9y ago
Given the cost of designing a CPU and setting up manufacturing capacity you could argue that they’re a natural monopoly. At the least there is a significant hurdle to entering the market, which intel can use to its advantage.
- chiefalchemist 9y ago
  Yes. But still a monopoly. And now that such chips are global the whole world's eggs are in a single basket. What could go wrong? Wait! I think they just answered that.

40acres 9y ago

I wonder which, if any, government organizaations knew about this. Did the DoD know? Russia? China? I remember reading about a "cyperweapon" the US government was using to cause North Korean missile tests to fail before launch. Could attacks like this be possible through meltdown?

yeasayer 9y ago

I think Intel might get away with it. Last 5 years they were slacking off, because economically there is no reason to go over the usual 10-15% yearly performance bump. But actually they were accumulating aces up their sleeves. Again, no reason to show your hand, if you don't have to. But the time has come. Right now Intel has 3 major problems: 1) Meltdown/Spectre situation 2) AMD is awoken from sleep with surprisingly good Ryzen lineup 3) Apple craves new powerful CPUs to satisfy unhappy MacBook Pro customers Intel can fix all of this with one sweep. Just by releasing a brand new CPU that will surprise everyone. Of course with hardware Meltdown/Spectre fix. They were holding off, but it's time to drop all these hidden aces on the table. And I believe it's gonna happen. Not right now with Cannon Lake, but with the one after - Ice Lake on 10nm transistors, by the end of 2018. It's going to be even bigger than NVIDIA's GTX 1080 success.

titzer 9y ago
If you think they can redesign their cache geometry, indirect branch predictors, and return stack buffers in the matter of a few months and then tape out new processors by the end of the year, you're nuts. It's gonna take 3 years minimum until even the easiest of those things is resolved and silicon hits the street, even if Intel begrudgingly admits they need to do this.
yorby 9y ago
They had an ace up their sleeve to fix those security issues? If that is true, they should get ready for the lawsuits I guess...
fyi1183 9y ago
Doubtful. You don't just develop a new processor over night, and if they truly had all these aces up their sleeves, they would have dropped them already in response to Zen last year. Intel's process advantage is shrinking. They're struggling like everybody else because the physics is getting harder and harder. Apart from the fact that it would have been nice to get easy process shrinking forever, this is good news for almost everybody: it means competition for them is getting tougher.
- 9y ago

cybervegan 9y ago

The holes in this article belie an fundamental misunderstanding of how the flaw works, and, how computers in general work. I agree with the general premise of the article, but if they don't understand it, they should avoid trying to explain it.

rdiddly 9y ago

I'm confused, did Vegas change from a place that's all about a show, to one where one expects to find seriousness, honesty, contrition? In a keynote?

jwilk 9y ago

> Starting in the mid-2000s, Intel added a layer of security within its chips and began encouraging developers to store users’ most sensitive information in the walled-off area rather than in regular software memory. What "layer of security" and "area" they are talking about?

nootropicat 9y ago
It's a very confusing attempt to explain the difference between kernel and user memory space. I don't think article's authors understand it.
- jwilk 9y ago
  Yeah, but that'd be 1980s, not 2000s. :-\
  - capitalsigma 9y ago
    I think they're talking about going from an unprotected to a protected memory model. The windows 9x line was unprotected (ending with "Windows ME" circa 2000) and NT was protected. The first consumer NT was XP in, what, 2002? That lines up with their "early 2000's" comment. Why they're deciding to credit Intel with protected memory models is beyond me, though. Maybe they thought they needed to give some credit to Intel for something to make the article seem more balanced.
  - JdeBP 9y ago
    Yes, the article got both the purpose and the dates quite wrong.
foobarbazetc 9y ago
I think they’re talking about TPM.
drxzcl 9y ago
I’m guessing SGX.

HugoDaniel 9y ago

They are too big to fail. It is us, the users, who have a problem: we have to put up with their mess and shady tactics.

5ilv3r 9y ago

Lots of Intel apologists in this thread. I for one am excited by the idea of healthy competition in the processor market.

HenryBemis 9y ago

To quote from the "Quest for the Holy Grail" and the scene with the Black Knight (guarding the 'bridge'): "'Tis but a scratch". Intel doesn't care. They will downplay it, misinform and misdirect till the cows go home. No point beating a dead horse. The only think Intel (and most other corporations) unerstand is to stop buying their products. This is the only language they 'speak'.

simik 9y ago

> Krzanich showed off a full-size pilotless helicopter Wait... what?

elihu 9y ago
That was a Volocopter. I think it uses some Intel parts or technology, but I don't remember what exactly.

Nokinside 9y ago

Intel still has the advantages that allow them to screw up and survive. 1. Process knowledge and manufacturing capacity. You can buy from others only as much as they have manufacturing capacity. Only real threat to Intel comes from combined volume of GlobalFoundries, TSMC, Samsung and UMC. Apple, NVIDIA, AMD, ARM and Qualcomm can get past Intel only trough these companies. 2. Profit margins. Intel makes 60 percent profit margins, AMD struggles from decade to decade. That's not a coincident. It's the direct result of pricing decisions by Intel. Whenever AMD gets ahead Intel in uP technology, Intel has always the option of cutting profit margins and prevent AMD from gaining more market share.

Tharkun 9y ago
The odd bit of anti-competitive behaviour (and billion-dollar lawsuits that come with it) is also something of an advantage...if an unfair one.

frankharv 9y ago

The article has some false information "Intel says it’s already provided software fixes for 90 percent of its chips" This is a falsehood. They MCU updates only cover IvyBridge and newer CPU's. Check the dates on the MCU files.

Animats 9y ago

Bloomberg says Intel has a big problem. The Economist says Intel has a big problem. Three class actions already filed against Intel. Intel has a big problem. They're probably going to have to replace a lot of CPUs.

rphlx 9y ago
May not be a winnable argument on HN (where the consensus seems to be that this is nearly-100% Intel's fault), but I think a significant fraction of the blame properly belongs on their customers, particularly their multi-tenant public cloud customers, for assuming a level of HW thread and guest isolation that has never actually existed. These huge-scale customers did not do proper security due dil on the silicon they were buying and made assumptions that were never, strictly speaking, guaranteed by Intel, and in some cases were explicitly documented as not guaranteed within the Intel optimization manuals.
- bsder 9y ago
  > These huge-scale customers did not do proper security due dil on the silicon they were buying and made assumptions that were never, strictly speaking, guaranteed by Intel, and in some cases were explicitly documented as not guaranteed within the Intel optimization manuals. But the commodity hardware is SOOOOOO much cheaper, you know? Everything about Intel was always about "good enough" from since probably ... 1982? And "good enough" security in hardware was always "nobody cares". IBM, certainly, was screaming about the level of insecurity in commodity hardware and software forever. DEC similarly. But commodity hardware is SOOOO much cheaper. No one. And I mean NO ONE was every going to give up even 10% on performance or cost in order to be even slightly more secure. At any level of the stack. Intel, Microsoft, Google ... all are guilty of this up until probably this year. Anybody who suggested that would have gotten laughed at and/or fired. The market spoke--and security became an afterthought. Sadly, this is STILL true. While there is much gnashing of teeth about Intel, everybody's implementation of security is far worse. The thing that is biting Intel is that the monoculture means that it is a universal and scalable tool as opposed to at the software level where each individual company has to be compromised in a slightly different way. It's only been since everybody is putting everything in the cloud that people now care about actual absolute values of security. The problem is that all of the hardware solutions to these bugs cost RAM somewhere. And RAM is now the gating factor of cost and performance on most chips. RAM fell off the Moore's Law curve back about 32-22nm and isn't coming back. So, the performance hit to mitigate this is real. No one was going to be the first to fix this EVEN IF THEY KNEW AND CARED. Everybody learned from painful business experience that the first guy gets all the arrows and the second guy gets all the profits. So, everybody was going to wait until they were the second guy--which was only going to happen when something bit everybody.

exabrial 9y ago

Well written article! Definitely a few waited in there that explain the problem in plain English

exabrial 9y ago

x86 is a problem... Itanium was supposed to be the life boat but it came too soon.

pmlnr 9y ago
Alpha? SPARC?

bigbugbag 9y ago

> The company makes about 90 percent of the world’s computer processors and 99 percent of the server chips in the data centers that effectively run the internet. Since when do datacenter servers run the internet ? The journalist seem to not understand the role of routers and network equipment to connect those servers. You could add AS to the mix but the datacenter servers are connected to the internet not running it. The internet would still work if we removed all those servers, it would work as intended even.

anonu 9y ago

From the article: >> Starting in the mid-2000s, Intel added a layer of security within its chips and began encouraging developers to store users’ most sensitive information in the walled-off area rather than in regular software memory. Can anyone explain what the author is referring to as "walled-off" area? L1, L2 Cache?

taspeotis 9y ago
Trusted Platform Module.
JdeBP 9y ago
This is a botched attempt to explain the user/supervisor mode distinction, that gets the dates and the purpose wrong.

MechEStudent 9y ago

Paywalled?

StillBored 9y ago

I don't know why people are so focused on intel here. Its not like other processors aren't affected, even ARM's latest core (A75 https://developer.arm.com/support/security-update https://developer.arm.com/support/security-update) is susceptible to meltdown. I suspect that if they had been building aggressive OoO CPU's with deep ROB rather than focusing on perf/W there would be a lot more cores on that list. Similarly IBM's high end POWER processors are also vulnerable (although they don't break it down as nicely as ARM https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/ https://www.ibm.com/blogs/psirt/potential-impact-processors-...) So, everyone is like Intel is so bad, when they just happen to be the one that people are running the most untrused code on. Let me quote IBM "This vulnerability doesn’t allow an external unauthorized party to gain access to a machine, but it could allow a party that has access to the system to access unauthorized data." People on this board are upset, because after spending the last decade+, making promises about how secure "cloud computing" is, once again the naysayers were proven correct. This time the flaw is so fundamental that in order to fix it you have the OS vendors making changes the destroy system performance for most applications that are I/O or just syscall intensive. This likely won't be the last time either if history is to be believed. But javascript you cry, again I'm going to say that you shouldn't be running random code from random people on the internet. I'm not a big fan of intel, but in a way I applaud them for pushing back against what I view as the crazy extent people go to in order to allow native code execution from untrused sources. I would much prefer this change be isolated to hypervisors, and have chrome/ff/etc detune their JIT's a bit to keep people from running cache timing attacks. So, I likely will be turning the kpti off on most of my machines the same way I run them with the iommu's disabled because I'm not running VM's with untrused code. (BTW, once the dust settles, i'm guessing a pretty large number of other aggressive OoO processors are vulnerable as well (old Alpha/PA-RISC/SPARC/etc)).

guhcampos 9y ago

The article is ridiculously biased. It makes absolutely no sense to talk about "moving away from Intel" to anything else because of Spectre. Every modern CPU is vulnerable to this type of attack. The "fix" involves turning off branch prediction, and that will slow down any CPU, from any vendor, of any platform. CPUs which are not affected generally do not take advantage of branch prediction anyways, and that generally makes them less powerful. Why the hell would anyone move from an underpowered Intel chip, spending copious amounts of money for such migration (you don't just change your CPU), and replace it with an even less powerful chilp? And Meltdown... Well, that's just the FIRST platform specific vulnerability found using the Spectre strategy. There will be more, hell, there are probably more already, just not published yet. No brand is safe, this is not an Intel bug, it's a bug in Computer Science itself. If anyone wants to profit from it, they'll need more than paid Bloomberg posts, they'll need to rethink how we build processors.

deleted 9y ago

[deleted]

Pica_soO 9y ago

Here we are at the high point of our historic exhibition of the horrors of the 22 century. The first public occurance of public/private law. A company which had a major flaw in its products, secretly negotiated a silent phase out of its flawed products for its bigger customers creating a private settlement, while avoiding the public courts by declaring the error trivial. This company was too entrenched to fail, as in every big actor agreed upon that seeing the company go under and half of all legacy software rewritten to accommodate new hardware, was not in the interest of a "informed" public. Liberal fanatics of course, had no such distributed hostage effect in there market-models, and where under the illusion that the Anorexia state they created, was still too much of a influence, while in truth the upholder of citizen rights was not even present anymore at the negotiation table. This catastrophe would later on lead to a heretic movement among the fanatics, that viewed hardware dependence in legacy not as something ugly but inevitable, but something threatening to their deity, the one free market. Please follow me into the next exhibition hall, where we will see the reintroduction of generational slavery by debt for the underclass. Please watch your steps, some of the tiles on the floor are in slight disrepair-

danpalmer 9y ago

I think Spectre and Meltdown are a fantastic opportunity to rediversify the CPU market, and I don’t think it could have come at a better time. - AMD has just had a great release with Ryzen, showing they can compete on a price/performance basis. - Apple is moving core OS functionality on its newest desktops/laptops on to Apple designed ARM chips. - Mobile platforms are getting bigger, especially with things like ChromeOS that could be (are being?) easily run on ARM based hardware. - Open Power has come a long way and could be poised to take some of the server market for customers who want more control than they got with Intel. I’m excited for this. Obviously the vulns are an issue that needs to be solved, but we could get some real competition in terms of manufacturers, and even in terms of architecture. The industry will take some time to readjust to compiling for/running on multiple architectures, which I think much of the industry hasn’t needed to deal with for a while. The result though will be a market where customers can choose an architecture that makes sense for their use case, and can choose from a range of good options. (I realise other chips are vulnerable, not just Intel, but the publicity has been Intel focused and I don’t think the technicalities of it matter too much)

alkonaut 9y ago

Long term Intel will have to "fix" these issues - but what about short term? Even if they won't have to replace sold processors (which is not likely), what about CPU's in their current pipeline? If properly fixed chips are 3 years out, what are they doing for 2018/19? Are they just going to keep making small tweaks to their current chips, and sell them with the known flaws?