55 ms·
Should they be describing it as 8 cores 16 threads when there have been multiple security vulnerabilities that have to turn off hyperthreading to be mitigated?
by lkschubert8 7y ago
Should they be describing it as 8 cores 16 threads when there have been multiple security vulnerabilities that have to turn off hyperthreading to be mitigated?
- jayflux 7y agoWhat else would they describe it as? There are 8 cores and 16 threads, whether you have to turn off the hyperthreading feature or not is a different matter.
- hmottestad 7y agoI think that if you turn off hyperthreading it becomes 8 core 8 threads.
- lkschubert8 7y agoYeah you are correct.
- lkschubert8 7y agoIt just feels kinda shady to advertise the peak performance with safety features that should be on off without mentioning that. They should at least include a disclaimer.
- matz1 7y agoPutting disclaimer is like voluntary shooting themselves in the foot. Most consumer wouldn't care about this anyway and the risk was overblown.
- hmottestad 7y agoThis is a very good point. I hope AMD brings it up with the EU. Might be a very slow process though, but at this point it is anticompetitive behaviour. AMD could probably squeeze a fair bit more performance out of their processors if they were allowed to cut some security corners.
- fwip 7y agoWho do you think is disallowing AMD from cutting security corners? (Not rhetorical)
- lkschubert8 7y agoEthics, the researchers exposing these exploits and proper implementation of the x86 ISA.
- nl 7y agoNo one "allowed" Intel to cut security corners. It was an oversight and took a long time to discover and understand the impact of. Even when people started speculating (ha!) that speculative execution could be problematic it took years before they managed to exploit it.
- spronkey 7y agoI hear many people continuing to say that Intel are "cutting security corners". Are they really? I don't have an extremely deep understanding of Intel's implementation of x86 ISA, but I do know enough to say that so far we've been able to effectively mitigate almost all of these attacks with existing instructions available on the Intel CPUs. That doesn't mean that they are still not open to other variants of these attacks - but at some point you have to assume diminishing returns. Spectre is still very difficult to exploit, for example. Perhaps this has little to do with Intel and more to do with software authors cutting corners? LFENCE and SFENCE are reasonably well documented, after all...
- hajile 7y agoHere's a register article from 2007 about page table permissions being problematic. If you look around a bit, there were a ton of security researchers who talked about the problem. It seems to have been a bit of an open secret that such a thing must exist -- they just hadn't found it yet. https://www.theregister.co.uk/2007/06/28/core_2_duo_errata/ https://www.theregister.co.uk/2007/06/28/core_2_duo_errata/ The scariest part is that many of the best security minds work for various intelligence agencies. They very likely have known about such things for a very long time. Meltdown strikes me as an almost perfect vulnerability. It affects almost everyone. It is undetectable until exploited and once exploited, it immediately goes away until the next time. It's easy to keep secret. Most importantly, it's a one-way vulnerability. Keep your secure systems from running untrusted code and there's zero risk. Since this is standard protocol anyway for those systems, you don't have the risk of someone running across a code patch somewhere. The only potential downside is that the juiciest targets also aren't running untrusted code (though most foreign affairs workers probably run untrusted code). The big point of interest here is information symmetry. In most cases, giving others secret information is bad. In this case, both the best and worse case situations work out well for the USA. If nobody else knows, they get free info. If everyone else does know, then everyone gets perfect information about everything. This favors the most powerful country. They can eliminate the unknowns (the only real danger). In contrast, knowing you are going to be crushed does nothing if you can't hide your own hand either. So, the best case is very good and the worst case is still acceptable.
- saltyshake 7y agoBesides cloud providers running VMs /containers on the cloud, is Spectre/Meltdown really such an issue for day-to-day consumers ?
- infotogivenm 7y agoYes. I think this is a common misconception. These attacks work fine in the browser, as researchers continue to show. They allow complete bypass of any native app sandboxing layers. Surely you don't run everything on your box as root all the time.
- mjrow 7y agoI'll keep HT on because I use NoScript and I encourage others to do the same.
- d33 7y agoMeh. It doesn't require Javascript for your computer to run logic described by others. Browsers are such complex machines that it wouldn't surprise me if you could for example craft a malicious SVG that would bypass that, or a turing-complete CSS file that triggers a vulnerability... By the way, does NoScript actually block in-SVG javascript?
- dual_basis 7y agoSure, but we all take risks every day. If you're worring about turning-complete CSS files exploiting Spectre and Meltdown then you probably don't leave the house much.
- ben_w 7y agoWe know that attackers have reason to exploit literally all compute resources they can find a way to access. This is more like worrying about leaving the house during an epidemic of exploding ebola-infected pigeons — if you can do something about it, you should.