3 ms·

I wonder if it might not come to bite them though. Doing it this way means that the media will constantly keep talking about yet another vulnerability in Intel

I wonder if it might not come to bite them though. Doing it this way means that the media will constantly keep talking about yet another vulnerability in Intel CPUs for years. There's a chance that Intel might and up picking a reputation like Flash did for being insecure.

reacweb 7y ago
Or like java applet. Oracle has killed java applet by not handling security issues in a responsible manner.
- yrro 7y ago
  To be fair the entire approach was flawed and should have been abandoned in favour of SELinux plus something like seccomp years before.
  - zzzcpan 7y ago
    Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.
    - cyberpunk 7y ago
      How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...
      - mmis1000 7y ago
        seccomp actually has that ability to allow only small portion of selective operations. Block everything except io is just one of its blocking mode. And the list is even configurable. Docker do use such ability to filter out sys-calls that shouldn't be used in the container.
- pjmlp 7y ago
  Sun...
- nradov 7y ago
  Java applets died primarily due to the terrible user experience and inconsistent browser support. Security issues were less of a factor.
AJ007 7y ago
In this case, the FBI and SEC may need to investigate precisely what is going on. If Intel is doing partial fixes it knows of other things that aren’t being disclosed there could be criminal activity occurring. Additionally, this had big implications for cloud providers. If additional liabilities of data leaks are foisted on companies, insurance companies and corporate counsel may just say no more using amazon, google cloud, azure, etc.
- kevin_thibedeau 7y ago
  > here could be criminal activity occurring. More likely some agencies don't want their exploits to stop working.
  - tracker1 7y ago
    Which is sad... It wouldn't bug me nearly as much if they (NSA etc) had a sunset/disclosure policy of a reasonably short timeframe (say 60 days or so) for disclosure to the org that makes the software/hardware. I can understand a state agency keeping a security flaw a secret to exploit in the near term... but stockpiling for years only to let stuff leak eventually is just irresponsible. Note: I'm not saying that I like state sponsored hacking, only that I understand it being a reality and pragmatically wish they struck a better balance.

reacweb 7y ago

Or like java applet. Oracle has killed java applet by not handling security issues in a responsible manner.

yrro 7y ago
To be fair the entire approach was flawed and should have been abandoned in favour of SELinux plus something like seccomp years before.
- zzzcpan 7y ago
  Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.
  - cyberpunk 7y ago
    How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...
    - mmis1000 7y ago
      seccomp actually has that ability to allow only small portion of selective operations. Block everything except io is just one of its blocking mode. And the list is even configurable. Docker do use such ability to filter out sys-calls that shouldn't be used in the container.
pjmlp 7y ago
Sun...
nradov 7y ago
Java applets died primarily due to the terrible user experience and inconsistent browser support. Security issues were less of a factor.

AJ007 7y ago

In this case, the FBI and SEC may need to investigate precisely what is going on. If Intel is doing partial fixes it knows of other things that aren’t being disclosed there could be criminal activity occurring. Additionally, this had big implications for cloud providers. If additional liabilities of data leaks are foisted on companies, insurance companies and corporate counsel may just say no more using amazon, google cloud, azure, etc.

kevin_thibedeau 7y ago
> here could be criminal activity occurring. More likely some agencies don't want their exploits to stop working.
- tracker1 7y ago
  Which is sad... It wouldn't bug me nearly as much if they (NSA etc) had a sunset/disclosure policy of a reasonably short timeframe (say 60 days or so) for disclosure to the org that makes the software/hardware. I can understand a state agency keeping a security flaw a secret to exploit in the near term... but stockpiling for years only to let stuff leak eventually is just irresponsible. Note: I'm not saying that I like state sponsored hacking, only that I understand it being a reality and pragmatically wish they struck a better balance.