5 ms·

You would think. But if you don't buy Microsoft, Apple, Intel, AMD what do you buy? There is no alternative.

by GoToRO 9y ago

ISL 9y ago
The mitigation and litigation costs to the large players, even in the case of a successful defense, are surely larger than $250k.
- GoToRO 9y ago
  For sure. But then you need somebody with vision, that will spend extra money on research so that these kinds of bugs don't happen. Then a new "smart" CEO comes and slashes budgets. Everybody is happy, they have the same sales but lower costs. Then, after years, the bugs are found. Now it's too late. You have to allocate money to mitigate and on top of that you have to spend more money on research and then spend a little on bug bounties. It's too late to go back now. The problem is how do you recognize a truly good CEO vs. a CEO that lowers costs and makes everybody happy.
  - tux1968 9y ago
    Market pressure will always drive outcomes, so you have to incentivize for the outcome you desire. It's far from clear how to bias such speculative (no pun intended) future costs against immediate returns even if you could identify a truly good CEO.
    - anonymfus 9y ago
      >Market pressure will always drive outcomes Not necessary! Many CPU architectures and implementations were created by academic institutions, so nationalisation of this industry should be considered a possibility.
  - eftychis 9y ago
    Market does not. CEOs are incentivized to please the markets and thus reduce investing at some point to prepare to exercise their stock options and sell. (There is plenty of discussion on what the exercise date should be and some people are pushing beyond 4 years for that reason.) A lot of companies set a 4 year window for their CEOs. Funneling capital into research, displeases stock holders, as you show reduced earnings. Observe that markets care about steady earning growth; catching these things before they happen in general will not earn you points. That is a sad part of human psychology. Think as a metaphor that an average manager will ask how many bugs did this guy fix and not how many bugs and security issues did this guy caught or saved us from. (See freaking Equifax -- https://www.marketwatch.com/investing/stock/efx https://www.marketwatch.com/investing/stock/efx -- they should have been out of business [my personal opinion]. Their stock price is fine. The only mistake of the CEO as far as SEC is concerned is he used inside information and sold.)
loosescrews 9y ago
These bugs are probably most valuable against cloud providers (Where else do you get arbitrary code execution on a machine with other's valuable data on it?). Most cloud providers run Linux, not Microsoft (except Microsoft) and definitely not Apple.
- guscost 9y ago
  Microsoft also runs the second largest cloud provider in the world.
- foobarian 9y ago
  The problem is that even if there is no practical exploit, you still have to patch. At our web company where there are no shared boxes we still spent untold resources upgrading kernels, rebooting servers, and then lost capacity due to performance degradations. Infrastructure is normally patched and rebooted on a regular schedule, but when a bug like this hits and requires an off-cycle upgrade it's a big cost.
- gopalakrishnans 9y ago
  Microsoft does have a lot of Linux VMs https://azure.microsoft.com/en-us/services/virtual-machines/ https://azure.microsoft.com/en-us/services/virtual-machines/
  - loosescrews 9y ago
    What matters is the host OS, not the guest.
_emacsomancer_ 9y ago
Raspberry Pi? It was unaffected [https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...].
- loeg 9y ago
  You're joking, right? Raspberry pi is a toy computer — which is entirely related to why it was unaffected by speculation leaks. It does not fulfill the same needs as full size x86 chips.
- ComputerGuru 9y ago
  Meh. They got lucky because they didn’t use affected hardware due to valuing price over performance. It’s certainly not because of any brilliant insight or preventative measures they took.
krylon 9y ago
I know it is not a realistic alternative for many needs, but Intel's Atom cores are not affected by Meltdown or Spectre.
- GoToRO 9y ago
  At least some of them are: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...
  - krylon 9y ago
    Aaaaaw, come on! :(

You would think. But if you don't buy Microsoft, Apple, Intel, AMD what do you buy? There is no alternative.

by GoToRO 9y ago

You would think. But if you don't buy Microsoft, Apple, Intel, AMD what do you buy? There is no alternative.

ISL 9y ago

The mitigation and litigation costs to the large players, even in the case of a successful defense, are surely larger than $250k.

GoToRO 9y ago
For sure. But then you need somebody with vision, that will spend extra money on research so that these kinds of bugs don't happen. Then a new "smart" CEO comes and slashes budgets. Everybody is happy, they have the same sales but lower costs. Then, after years, the bugs are found. Now it's too late. You have to allocate money to mitigate and on top of that you have to spend more money on research and then spend a little on bug bounties. It's too late to go back now. The problem is how do you recognize a truly good CEO vs. a CEO that lowers costs and makes everybody happy.
- tux1968 9y ago
  Market pressure will always drive outcomes, so you have to incentivize for the outcome you desire. It's far from clear how to bias such speculative (no pun intended) future costs against immediate returns even if you could identify a truly good CEO.
  - anonymfus 9y ago
    >Market pressure will always drive outcomes Not necessary! Many CPU architectures and implementations were created by academic institutions, so nationalisation of this industry should be considered a possibility.
- eftychis 9y ago
  Market does not. CEOs are incentivized to please the markets and thus reduce investing at some point to prepare to exercise their stock options and sell. (There is plenty of discussion on what the exercise date should be and some people are pushing beyond 4 years for that reason.) A lot of companies set a 4 year window for their CEOs. Funneling capital into research, displeases stock holders, as you show reduced earnings. Observe that markets care about steady earning growth; catching these things before they happen in general will not earn you points. That is a sad part of human psychology. Think as a metaphor that an average manager will ask how many bugs did this guy fix and not how many bugs and security issues did this guy caught or saved us from. (See freaking Equifax -- https://www.marketwatch.com/investing/stock/efx https://www.marketwatch.com/investing/stock/efx -- they should have been out of business [my personal opinion]. Their stock price is fine. The only mistake of the CEO as far as SEC is concerned is he used inside information and sold.)

loosescrews 9y ago

These bugs are probably most valuable against cloud providers (Where else do you get arbitrary code execution on a machine with other's valuable data on it?). Most cloud providers run Linux, not Microsoft (except Microsoft) and definitely not Apple.

guscost 9y ago
Microsoft also runs the second largest cloud provider in the world.
foobarian 9y ago
The problem is that even if there is no practical exploit, you still have to patch. At our web company where there are no shared boxes we still spent untold resources upgrading kernels, rebooting servers, and then lost capacity due to performance degradations. Infrastructure is normally patched and rebooted on a regular schedule, but when a bug like this hits and requires an off-cycle upgrade it's a big cost.
gopalakrishnans 9y ago
Microsoft does have a lot of Linux VMs https://azure.microsoft.com/en-us/services/virtual-machines/ https://azure.microsoft.com/en-us/services/virtual-machines/
- loosescrews 9y ago
  What matters is the host OS, not the guest.

_emacsomancer_ 9y ago

Raspberry Pi? It was unaffected [https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...].

loeg 9y ago
You're joking, right? Raspberry pi is a toy computer — which is entirely related to why it was unaffected by speculation leaks. It does not fulfill the same needs as full size x86 chips.
ComputerGuru 9y ago
Meh. They got lucky because they didn’t use affected hardware due to valuing price over performance. It’s certainly not because of any brilliant insight or preventative measures they took.

krylon 9y ago

I know it is not a realistic alternative for many needs, but Intel's Atom cores are not affected by Meltdown or Spectre.

GoToRO 9y ago
At least some of them are: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr https://security-center.intel.com/advisory.aspx?intelid=INTE...
- krylon 9y ago
  Aaaaaw, come on! :(