3 ms·

I wasn't trying to put words in your mouth, it's just what I could conclude from this put in context: > It wasn't hindsight: we've been publishing and describi

I wasn't trying to put words in your mouth, it's just what I could conclude from this put in context: > It wasn't hindsight: we've been publishing and describing these risks along with techniques to mitigate them for decades. >https://news.ycombinator.com/item?id=16092183 https://news.ycombinator.com/item?id=16092183 It worked for decades and the issues were "ignored" (not given much of a second thought) because everybody assumed that's all there is to the exploits. Corner cases that can be easily mitigated in software. It's just when everybody realized that the whole implementation in hardware was broken that the point was driven home. Performance is what sold those CPUs when security just couldn't. Without the critical mass of revelations recently I doubt security would have been considered too much today. Just like privacy became a concern only with a similarly shocking volume of revelations. So looking back it's hard to say if Intel would have chosen another way. Yeah, in hindsight you could say "if they just fixed it back then..." but in reality nobody would have cared.

nickpsecurity 8y ago
"Performance is what sold those CPUs when security just couldn't. Without the critical mass of revelations recently I doubt security would have been considered too much today. " I meant to respond to this earlier. Yeah, it seems the mainstream acts when it's in their face, there's working exploits, they're dressed up somehow, and there's an immediate action to take. I guess the route to get secure hardware/software architectures is a series of highly-publicized breaks in every component with a Right Thing solution and alternative suppliers that used it. They also move fastest when the damage is high. So there's a recipe for change. Of course, there's possibly some ethical and legal issues in there. ;)

nickpsecurity 8y ago

"Performance is what sold those CPUs when security just couldn't. Without the critical mass of revelations recently I doubt security would have been considered too much today. " I meant to respond to this earlier. Yeah, it seems the mainstream acts when it's in their face, there's working exploits, they're dressed up somehow, and there's an immediate action to take. I guess the route to get secure hardware/software architectures is a series of highly-publicized breaks in every component with a Right Thing solution and alternative suppliers that used it. They also move fastest when the damage is high. So there's a recipe for change. Of course, there's possibly some ethical and legal issues in there. ;)