4 ms·
No paper up yet, but there's a discussion on seclists https://seclists.org/oss-sec/2018/q4/127 https://seclists.org/oss-sec/2018/q4/127
by DeepYogurt 8y ago
No paper up yet, but there's a discussion on seclists
https://seclists.org/oss-sec/2018/q4/127 https://seclists.org/oss-sec/2018/q4/127
- Aissen 8y agoCode is up before paper (linked in the article and mailing list discussion), which is rare enough to be praised: https://github.com/bbbrumley/portsmash https://github.com/bbbrumley/portsmash
- yread 8y ago01 Oct 2018: Notified Intel Security 26 Oct 2018: Notified openssl-security 26 Oct 2018: Notified CERT-FI 26 Oct 2018: Notified oss-security distros list 01 Nov 2018: Embargo expired Why even do an embargo if you give hardware people 1 month and software people 1 week?!
- ysleepy 8y agoBad experience in the past probably. Also this probably just leads to the official recommendation to disable Hyper-Threading "for security critical applications" or some PR blurb.
- rincebrain 8y agoAny number of possible reasons. OpenSSL shipped a patch for it in that interval. Intel isn't going to fix it faster than OpenSSL ships a patch revealing it unless they already had a convenient killbit for the affected things. I have no idea what the relevant researcher's policies are, but I would assume we'll hear about it if somebody requested a longer embargo and they refused. (It also appears to be much harder to reproduce in the presence of dynamic clock speeds, so the impact in most smaller environments is going to be low unless someone does further work to make it reproduce well with that.)