3 ms·

Trivial, yet nobody has managed to produce a working exploit that doesn't require a running start. The poc exploits wouldn't work in the wild. They are running

Trivial, yet nobody has managed to produce a working exploit that doesn't require a running start. The poc exploits wouldn't work in the wild. They are running with interference of a real system. Also, meltdown requires the data to be snooped to be in L1D cache. So the current demo exploit has to keep pushing the data into cache to be read. Something simple like steal a password from sudo should be trivia right? I'd not convinced i need to worry. And making non public facing machines pay the price of the mitigation seems like too much.

ageofwant 9y ago
Absolutely. I will be really pissed of if I'm forced to run a -30% kernel performance on my dev laptop, or god knows how much of my 1/2 decade old T420's to fix a problem I don't have. Yes, I expect my cloud provider and bank to apply the patch, my ARM based router is fine. Thanks, but no thanks, do not want.
- cryptonector 9y ago
  You have secrets, some of them worth a lot: - cookies (e.g., for online banking sessions) - keys (e.g., for pushing to git repos) - browser history - identities (oh, did you post anonymously somewhere?) - ... PoC code that runs in-browser exists. It's only a matter of time before it's weaponized.
  - aidenn0 9y ago
    That's spectre, not meltdown with the in-browser PoC
  - jnordwick 9y ago
    There is no in browser meltdown exploit at all. And even the whitepaper doesn't have a working js exploit of spectre, just a couple pieces and some assumptions.