7 ms·
The reason given by the Chromium people for using the Vendor string for security reasons strikes me as utterly backwards for multiple reasons: 1) They quote in
by pilif 14y ago
The reason given by the Chromium people for using the Vendor string for security reasons strikes me as utterly backwards for multiple reasons:
1) They quote incorrect x86 implementations and then even quote errata documents from both vendors while still also only trusting these two vendors, despite the fact that they just quoted them as en example for broken implementations.
2) By using the vendor string, they are ensuring that the intentionally broken implementations (those forging the ID string) get trusted, while the honest guys don't.
3) What they do in the end is encouraging CPU vendors to just forge their vendor string (see above).
Whatever reason they might actually have, I really doubt that trusting CPUs by stated name of the vendor does not at all increase the security of the system.
- raverbashing 14y agoReally Google, really?! Check the CPU capabilities for fscks sake! This is CPU features 101. Read the manufacturer's manual, they point that out. Sorry for the aggressive tone, but this is really idiotic. Checking CPU string is worse, more buggy and less compatible EVEN among different CPUs from the same vendor! "Because our system is potentially vulnerable to incorrect x86 implementations" Fine, check the capabilities FIRST, then check the string. Not the other way around. Same thing for the "firmware developers" who check for Windows and Red Hat at the string. Someone needs to buy a large batch of these and return them as being defective.
- pdw 14y agoRegarding point 1), they trust AMD and Intel because they receive errata documents from these vendors and can therefore learn about and work around CPU bugs that would affect them. It still seems an extremely paranoid stance to take.