5 ms·

Intel Finds Bug in AMD's Spectre Mitigation – AMD Issues Fix

121 points by News-Dog 5y ago

ece 5y ago
Also recently: https://news.ycombinator.com/item?id=30603600 https://news.ycombinator.com/item?id=30603600
edlebert 5y ago
Ironic.
- flatiron 5y ago
  In the article they explain it. People nudged intel to mitigate spectre like AMD. They looked into how they did it to learn more and found some flaws and responsibly disclosed them.
nyanpasu64 5y ago
The page now [EDIT: as of writing] points to a 404, and has been excluded from the Wayback Machine. However, it's still in Google Cache, which I've saved to https://web.archive.org/web/20220312144415/https://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fwww.tomshardware.com%2Fnews%2Fintel-discovers-amd-spectre-patch-has-been-broken-since-2018-amd-issues-fix https://web.archive.org/web/20220312144415/https://webcache..... The article might've been retracted for a reason though, IDK.
- News-Dog 5y ago
  OP: I've deleted my browser-cache and checked at UTC 15:00 2022-03-12 ; <https://www.tomshardware.com/news/intel-amd-spectre-v2-vulnerability-mitigation-bug-fix-patch-cpu-security https://www.tomshardware.com/news/intel-amd-spectre-v2-vulne...> Opens fine for me here?
  - nyanpasu64 5y ago
    It seems back up?
  - mynameismon 5y ago
    same here, loading fine on fresh load (opened it on my mobile earlier)
jagger27 5y ago
This kind of thing shows that Intel gives its STORM security team a lot of autonomy. The optics of this couldn’t be better, honestly.
- phendrenad2 5y ago
  If they found a problem and didn't report it, and someone leaked that fact to the press, that would be some very bad optics indeed, autonomy or no.
bhawks 5y ago
So I've been hobbling my CPUs performance for the past 4 years with a mitigation that doesn't actually mitigate. Must be a day ending in y.
- _0ffh 5y ago
  Oh, but it does mitigate - just turns out it don't mitigate enough.
  - bhawks 5y ago
    s/reservation/mitigation/ https://youtu.be/A-brgkkjnHc https://youtu.be/A-brgkkjnHc Jokes aside - I understand the difficulty to adequately defend against meltdown/spectre. When the exploits were released I was running a service which definitely needed protection from this type of attack. Ironically we had just finished a set of optimizations that would have reduced our cpu costs quite nicely, the mitigations ate all those wins and more. I guess I'm still bitter - I no longer own that system but it really frustrated me to hear that it apparently was still vulnerable to spectre style attacks.
    - danuker 5y ago
      > ate all those wins and more. At least you still have a relative advantage: if you had not optimized, the CPU costs would have increased even more.
      - deleted 5y ago
        [deleted]
- blibble 5y ago
  I turned them all off on all my production servers they don't run arbitrary untrusted code and send a LOT of packets, those mitigations really hurt
  - staticassertion 5y ago
tus666 5y ago
Aww.

121 points by News-Dog 5y ago

ece 5y ago

Also recently: https://news.ycombinator.com/item?id=30603600 https://news.ycombinator.com/item?id=30603600

edlebert 5y ago

Ironic.

flatiron 5y ago
In the article they explain it. People nudged intel to mitigate spectre like AMD. They looked into how they did it to learn more and found some flaws and responsibly disclosed them.

nyanpasu64 5y ago

The page now [EDIT: as of writing] points to a 404, and has been excluded from the Wayback Machine. However, it's still in Google Cache, which I've saved to https://web.archive.org/web/20220312144415/https://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fwww.tomshardware.com%2Fnews%2Fintel-discovers-amd-spectre-patch-has-been-broken-since-2018-amd-issues-fix https://web.archive.org/web/20220312144415/https://webcache..... The article might've been retracted for a reason though, IDK.

News-Dog 5y ago
OP: I've deleted my browser-cache and checked at UTC 15:00 2022-03-12 ; <https://www.tomshardware.com/news/intel-amd-spectre-v2-vulnerability-mitigation-bug-fix-patch-cpu-security https://www.tomshardware.com/news/intel-amd-spectre-v2-vulne...> Opens fine for me here?
- nyanpasu64 5y ago
  It seems back up?
- mynameismon 5y ago
  same here, loading fine on fresh load (opened it on my mobile earlier)

jagger27 5y ago

This kind of thing shows that Intel gives its STORM security team a lot of autonomy. The optics of this couldn’t be better, honestly.

phendrenad2 5y ago
If they found a problem and didn't report it, and someone leaked that fact to the press, that would be some very bad optics indeed, autonomy or no.

bhawks 5y ago

So I've been hobbling my CPUs performance for the past 4 years with a mitigation that doesn't actually mitigate. Must be a day ending in y.

_0ffh 5y ago
Oh, but it does mitigate - just turns out it don't mitigate enough.
- bhawks 5y ago
  s/reservation/mitigation/ https://youtu.be/A-brgkkjnHc https://youtu.be/A-brgkkjnHc Jokes aside - I understand the difficulty to adequately defend against meltdown/spectre. When the exploits were released I was running a service which definitely needed protection from this type of attack. Ironically we had just finished a set of optimizations that would have reduced our cpu costs quite nicely, the mitigations ate all those wins and more. I guess I'm still bitter - I no longer own that system but it really frustrated me to hear that it apparently was still vulnerable to spectre style attacks.
  - danuker 5y ago
    > ate all those wins and more. At least you still have a relative advantage: if you had not optimized, the CPU costs would have increased even more.
    - deleted 5y ago
      [deleted]
blibble 5y ago
I turned them all off on all my production servers they don't run arbitrary untrusted code and send a LOT of packets, those mitigations really hurt
- staticassertion 5y ago

tus666 5y ago

Aww.