4 ms·
What pain, no exploits have ever been documented. These mitigations are makeshift insurance for datacentres.
by papermachete 7y ago
What pain, no exploits have ever been documented. These mitigations are makeshift insurance for datacentres.
- saagarjha 7y agoYou can download PoCs from GitHub right now.
- papermachete 7y agoI've yet to see reports of one running involuntarily in the wild.
- saagarjha 7y agoProbably because most systems quickly adopted mitigations and attackers then moved back to lower-hanging fruit.
- WanderPanda 7y agoSo you are saying the anti-vaxxers of the linux world are protected by herd immunity? Interesting angle for sure!
- pixl97 7y agoIn March of 2019 there were no world wide pandemics forcing hundreds of millions to shelter in place. The point is you vaccinate before a illness starts spreading if you can, because things spread quickly when you do not and can create quite a mess.
- untog 7y ago"I've yet to see a horse run out, so why would I bolt this barn door?"
- papermachete 7y agoIt's a special type of horse that won't run out unless aliens from another galaxy throw space hay at the door.
- jbjohns 7y agoI'm truly shocked by the comments I'm seeing here. When did so many people forget everything we've learned about security? You know what a zero-day attack is right? You know how fast those can cover the whole internet these days right? So why would you purposely leave a gaping security hole in your system to get some performance on a CPU that's probably too fast for your realistic workload already?
- kfrzcode 6y agoI've never seen reports indicating any exploit running involuntarily in the wild, ever. That fact, however, does not validate my position.
- icedchai 7y agoThese academic PoCs read data that they themselves have staged during execution. This is very different from reading arbitrary, random memory that contains something like a cookie for another web site, password, or SSH key. When someone is looking for a real world exploit, this is what they want.
- saagarjha 7y agoI don't think anyone has actually bothered to a microarchitectural side channel in practice yet.
- kfrzcode 6y agoThe operative word in my sentence is "may," indicating a level of uncertainty.