3 ms·

Expanding on #2, when thinking of things like Spectre & Meltdown ie CISC HW flaws, offloading or running a variety of services/daemons on physically separate ma

Expanding on #2, when thinking of things like Spectre & Meltdown ie CISC HW flaws, offloading or running a variety of services/daemons on physically separate machines can also improve security. We all get told to reduce the attack vector and this is one way to do that. The organisational hierarchy best exemplifies this security isolation point for an entity, like businesses, govts, etc etc.

qayxc 5y ago
> when thinking of things like Spectre & Meltdown ie CISC HW flaws Spectre in particular is not a CISC HW flaw. It affects ARM and other RISC architectures as well: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/addressing-spectre-variant-1-in-software https://developer.arm.com/support/arm-security-updates/specu...
- Terry_Roll 5y ago
  Know your HW. https://www.raspberrypi.com/news/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.com/news/why-raspberry-pi-isnt-vulne... "Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use."
  - bullen 5y ago
    A72 is susceptible to Spectre because it has speculative execution I think. That article was written before the release of Pi 4: 5th Jan 2018 https://forums.raspberrypi.com/viewtopic.php?t=243416 https://forums.raspberrypi.com/viewtopic.php?t=243416 You don't get to 2 Gflops/W that easily!
    - Terry_Roll 5y ago
      Someone ran a checker on the RPI4 https://forums.raspberrypi.com/viewtopic.php?t=243416#p1534481 https://forums.raspberrypi.com/viewtopic.php?t=243416#p15344... Results https://pastebin.com/GLRy6uWK https://pastebin.com/GLRy6uWK "> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulne rable) > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK C VE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-1212 6:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK We're missing some kernel info (see -v), accuracy might be reduced Need more detailed information about mitigation options? Use --explain A false sense of security is worse than no security at all, see --disclaimer" Still seems to be in the clear but some info cant be obtained which might change the results.

qayxc 5y ago

> when thinking of things like Spectre & Meltdown ie CISC HW flaws Spectre in particular is not a CISC HW flaw. It affects ARM and other RISC architectures as well: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/addressing-spectre-variant-1-in-software https://developer.arm.com/support/arm-security-updates/specu...

Terry_Roll 5y ago
Know your HW. https://www.raspberrypi.com/news/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.com/news/why-raspberry-pi-isnt-vulne... "Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use."
- bullen 5y ago
  A72 is susceptible to Spectre because it has speculative execution I think. That article was written before the release of Pi 4: 5th Jan 2018 https://forums.raspberrypi.com/viewtopic.php?t=243416 https://forums.raspberrypi.com/viewtopic.php?t=243416 You don't get to 2 Gflops/W that easily!
  - Terry_Roll 5y ago
    Someone ran a checker on the RPI4 https://forums.raspberrypi.com/viewtopic.php?t=243416#p1534481 https://forums.raspberrypi.com/viewtopic.php?t=243416#p15344... Results https://pastebin.com/GLRy6uWK https://pastebin.com/GLRy6uWK "> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulne rable) > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK C VE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-1212 6:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK We're missing some kernel info (see -v), accuracy might be reduced Need more detailed information about mitigation options? Use --explain A false sense of security is worse than no security at all, see --disclaimer" Still seems to be in the clear but some info cant be obtained which might change the results.