4 ms·

Run this [1]. If it works, flush your caches or just update your kernel. If it doesn't, you checked off an item on your list. I misspoke, silicon should be mo

Run this [1]. If it works, flush your caches or just update your kernel. If it doesn't, you checked off an item on your list. I misspoke, silicon should be more like "system". Said it in this comment more about silicon fixes https://news.ycombinator.com/item?id=25665276 https://news.ycombinator.com/item?id=25665276 [1] https://gist.github.com/anonymous/99a72c9c1003f8ae0707b4927ec1bd8a https://gist.github.com/anonymous/99a72c9c1003f8ae0707b4927e...

eloff 6y ago
I don't think you understand spectre. Defending against a single POC is not the same thing as defending against this class of side channel vulnerabilities. Also your references to flushing caches and updating the kernel underlines to me that you don't know what you're talking about.
- ljhsiung 6y ago
  >> One can simply "check off the list" of attacks >> The more difficult/interesting problem is being future-proof
  - eloff 6y ago
    I feel like you're not communicating well here. What does checking an attack off your list mean to you? If it means you're safe from it now and in the future, then obviously you're wrong. I feel like that's a strawman and not your actual argument though.
    - eyelidlessness 6y ago
      I read it as: defending against known vulnerabilities is well defined, defending against future exploits in the same vein is unknown. Pretty reasonable analysis unless there’s some doubt about the known part?
      - tptacek 6y ago
        The impedance mismatch here is that someone is talking about defending against "vulnerabilities" when what they're really defending against is "exploits". Defending against exploits is antivirus, not security. Spectre is a broad class of attacks; there are categorical defenses, but you can't verify them by running a single POC.
        eloff 6y ago
        Yes, you've put your finger right on it, I think that's where he's coming from.
saagarjha 6y ago
TIL you can make an anonymous gist?
- toomuchtodo 6y ago
  This functionality was phased out by Github ~2 years ago. Existing anonymous gists previously created still stand.

eloff 6y ago

I don't think you understand spectre. Defending against a single POC is not the same thing as defending against this class of side channel vulnerabilities. Also your references to flushing caches and updating the kernel underlines to me that you don't know what you're talking about.

ljhsiung 6y ago
>> One can simply "check off the list" of attacks >> The more difficult/interesting problem is being future-proof
- eloff 6y ago
  I feel like you're not communicating well here. What does checking an attack off your list mean to you? If it means you're safe from it now and in the future, then obviously you're wrong. I feel like that's a strawman and not your actual argument though.
  - eyelidlessness 6y ago
    I read it as: defending against known vulnerabilities is well defined, defending against future exploits in the same vein is unknown. Pretty reasonable analysis unless there’s some doubt about the known part?
    - tptacek 6y ago
      The impedance mismatch here is that someone is talking about defending against "vulnerabilities" when what they're really defending against is "exploits". Defending against exploits is antivirus, not security. Spectre is a broad class of attacks; there are categorical defenses, but you can't verify them by running a single POC.
      - eloff 6y ago
        Yes, you've put your finger right on it, I think that's where he's coming from.

saagarjha 6y ago

TIL you can make an anonymous gist?

toomuchtodo 6y ago
This functionality was phased out by Github ~2 years ago. Existing anonymous gists previously created still stand.