4 ms·

You're right, that's exactly what this is. Just a way to defeat a defense in depth measure. This vulnerability it's useless by itself.

yosito 4y ago
So not the "last line of defense"?
- Filligree 4y ago
  It can reasonably be described as such. The headline implies that previous lines of defense have also been broken, which isn't the case.
- gruturo 4y ago
  It is. It's just that compromising the last line of defense, without compromising the ones which come before it, is not the end of the world. It's like if I could wave a magnet over your encrypted backup tapes, ruining your restore capability, but without having any ability to affect your production and DR sites. You'd rather it didn't happen, but you are still up and even have redundancy.
  - tester756 4y ago
    >is not the end of the world. today, how many years it took the theory to be applied in "real world" with other cpu vulns
    - rs_rs_rs_rs_rs 4y ago
      I don't think you understand this vulnerability. This will not become Spectre-like in 10 years from now. The impact will be the same as it is today.
      - tester756 4y ago
        Sorry, I meant chaining vulns, once they do appear
  - rc_mob 4y ago
    lol. apparently the article title is "technically the truth"
nimbius 4y ago
This is a dangerous position to hold. this vulnerability aids in reducing the overall security posture of the OS so its quite valuable. it improves an adversaries opportunities and however limited, still advances the potential for system compromise. Infosec isnt just home runs, it is iterative, cumulative progress toward a shared goal. things like this are what ultimately led to XBox and Playstation jailbreaks.
- api 4y ago
  This is correct, but at the same time it's important to not overhype every single vulnerability as the end of the world. Unfortunately some security people seem incentivized to do that, and it causes a "crying wolf" problem. Serious end of the world announcements should be reserved for serious end of the world vulnerabilities. This is a vulnerability that reduces the security of the Apple Silicon platform to being closer to on par with the immediate prior platform that Apple is actually still selling.
  - danaris 4y ago
    ...in certain, very restricted circumstances.

yosito 4y ago

So not the "last line of defense"?

Filligree 4y ago
It can reasonably be described as such. The headline implies that previous lines of defense have also been broken, which isn't the case.
gruturo 4y ago
It is. It's just that compromising the last line of defense, without compromising the ones which come before it, is not the end of the world. It's like if I could wave a magnet over your encrypted backup tapes, ruining your restore capability, but without having any ability to affect your production and DR sites. You'd rather it didn't happen, but you are still up and even have redundancy.
- tester756 4y ago
  >is not the end of the world. today, how many years it took the theory to be applied in "real world" with other cpu vulns
  - rs_rs_rs_rs_rs 4y ago
    I don't think you understand this vulnerability. This will not become Spectre-like in 10 years from now. The impact will be the same as it is today.
    - tester756 4y ago
      Sorry, I meant chaining vulns, once they do appear
- rc_mob 4y ago
  lol. apparently the article title is "technically the truth"

nimbius 4y ago

This is a dangerous position to hold. this vulnerability aids in reducing the overall security posture of the OS so its quite valuable. it improves an adversaries opportunities and however limited, still advances the potential for system compromise. Infosec isnt just home runs, it is iterative, cumulative progress toward a shared goal. things like this are what ultimately led to XBox and Playstation jailbreaks.

api 4y ago
This is correct, but at the same time it's important to not overhype every single vulnerability as the end of the world. Unfortunately some security people seem incentivized to do that, and it causes a "crying wolf" problem. Serious end of the world announcements should be reserved for serious end of the world vulnerabilities. This is a vulnerability that reduces the security of the Apple Silicon platform to being closer to on par with the immediate prior platform that Apple is actually still selling.
- danaris 4y ago
  ...in certain, very restricted circumstances.