4 ms·

New Spectre attack enables secrets to be leaked over a network

55 points by maltalex 8y ago

curiousgal 8y ago
I am starting to believe that safety and security online are unattainable. Every approach one can take to protect themselves seems like a castle built on sand.
- maltalex 8y ago
  ... much like in the real world
- ta346934634 8y ago
  We've built a big mud-pie with gaping holes everywhere it seems. Initially getting things working and networked was the goal I guess; security wasn't something people had really worried about (look at earlier network protocols - a lot of trusted stuff just by virtue of being on the same lan/wan). Mitigating timing attacks and branch prediction attacks over a network etc I don't think had even been heard of. The virus maker/anti-virus vendor self-feeding thing/arms-race is another crackup.
  - Skunkleton 8y ago
    When you consider how complicated computers are, the current state of security is a pretty impressive achievement.
  - mindfulhack 8y ago
    I wonder if it's scientific at all to speculate* that this computer security situation is an extension of the fact that biologically, we are built more to destroy (in our cells, and thus our evolutionary psychology) than create (i.e. stay healthy, endure, and be indestructible). Sure, we re-create, but that cycle aside, it's easier to attack and kill than to defend and live. In all of nature, it is easier to destroy than it is to create. Thus, our human-created systems of information technology are fundamentally trapped in the same paradigm as we are, with the same characteristics described as above. If that is true, then truly secure systems may only be possible if an 'AI' singularity occurs, i.e. once a tipping point of self-improving software to fundamentally happens in which it becomes able to re-invent itself as fast as it needs to be (a million times a second until ad infinitum), only then will computer security truly exist, because such a system of creation of no longer bound by nature's cells and earlier evolution. Until then, computer security is way too limited to our very primitive selves that it suffers from now. (*) sigh...
    - deleted 8y ago
      [deleted]
  - digi_owl 8y ago
    Iirc, various people wanted to build encryption etc into tcp/ip. But there was a this thing called the cold war going on, and thus encryption was treated as military hardware in the eyes of export law. Though really one could probably put the ultimate blame on the von Neumann architecture winning the CPU design prize. Thus any data can potentially be a program...
- ken 8y ago
  We're running untrusted code from dozens or hundreds of sources, every time we click the mouse button. This isn't a platform designed for maximum security. Yes, JS is the sand. TBL has written about the Principle of Least Power, and the specific benefits of HTML/CSS. By putting JS on every document on the internet, we've already lost.
jlebar 8y ago
Direct link to the paper: https://misc0110.net/web/files/netspectre.pdf https://misc0110.net/web/files/netspectre.pdf

55 points by maltalex 8y ago

I am starting to believe that safety and security online are unattainable. Every approach one can take to protect themselves seems like a castle built on sand.

maltalex 8y ago
... much like in the real world
ta346934634 8y ago
We've built a big mud-pie with gaping holes everywhere it seems. Initially getting things working and networked was the goal I guess; security wasn't something people had really worried about (look at earlier network protocols - a lot of trusted stuff just by virtue of being on the same lan/wan). Mitigating timing attacks and branch prediction attacks over a network etc I don't think had even been heard of. The virus maker/anti-virus vendor self-feeding thing/arms-race is another crackup.
- Skunkleton 8y ago
  When you consider how complicated computers are, the current state of security is a pretty impressive achievement.
- mindfulhack 8y ago
  I wonder if it's scientific at all to speculate* that this computer security situation is an extension of the fact that biologically, we are built more to destroy (in our cells, and thus our evolutionary psychology) than create (i.e. stay healthy, endure, and be indestructible). Sure, we re-create, but that cycle aside, it's easier to attack and kill than to defend and live. In all of nature, it is easier to destroy than it is to create. Thus, our human-created systems of information technology are fundamentally trapped in the same paradigm as we are, with the same characteristics described as above. If that is true, then truly secure systems may only be possible if an 'AI' singularity occurs, i.e. once a tipping point of self-improving software to fundamentally happens in which it becomes able to re-invent itself as fast as it needs to be (a million times a second until ad infinitum), only then will computer security truly exist, because such a system of creation of no longer bound by nature's cells and earlier evolution. Until then, computer security is way too limited to our very primitive selves that it suffers from now. (*) sigh...
  - deleted 8y ago
    [deleted]
- digi_owl 8y ago
  Iirc, various people wanted to build encryption etc into tcp/ip. But there was a this thing called the cold war going on, and thus encryption was treated as military hardware in the eyes of export law. Though really one could probably put the ultimate blame on the von Neumann architecture winning the CPU design prize. Thus any data can potentially be a program...
ken 8y ago
We're running untrusted code from dozens or hundreds of sources, every time we click the mouse button. This isn't a platform designed for maximum security. Yes, JS is the sand. TBL has written about the Principle of Least Power, and the specific benefits of HTML/CSS. By putting JS on every document on the internet, we've already lost.

jlebar 8y ago

Direct link to the paper: https://misc0110.net/web/files/netspectre.pdf https://misc0110.net/web/files/netspectre.pdf