Intelpocalypse

[levi]

Good for them. What are they doing about the spectre attacks now?

 

[Klumpen]

Good for them. What are they doing about the spectre attacks now?

[doublepost=1515276077,1515270245][/doublepost]Linus reacted:
http://www.businessinsider.com/linus-torvalds-linux-inventor-is-furious-at-intel-2018-1?IR=T

Torvalds asks: "Is Intel basically saying 'we are committed to selling you shit forever and ever, and never fixing anything'?"

 

[bubblebee]

Btw, someone made a proof-of-concept for Spectre on Linux :
github.com/Pl4gue/spectre-attack-demo

There is another quite interesting PoC for spectre. Maybe someone with a Pyra/Pandora can use/test this ?

 

[levi]

Falls over in exactly the same way on my Atom and Pentium machines.

It won't build on ARM machines because of the include on line 8. I'm not sure exactly what it's using out of this file at the moment (probably a few constants at most), but it won't run on Pandora without some changes at least.

 

[klapse]

Tested the meltdown patch on a Gimp compile. 8.2% slowdown.

I'm not even gonna talk about spectre tests.

 

[Grench]

Are there any modern CPUs that are truly immune? I'm thinking latest generation embedded, etc.

 

[levi]

Nobody really knows yet. Some CPUs might be safer than others, but it's still not really clear. If I had to place a bet on every individual modern CPU being affected, I'd bet that every OoO CPU is likely to have some exploitable flaw or other, and I reckon I'd probably end up making a profit.

 

[Silent-Hunter]

I think RISC-V is?

 

[levi]

I'm not counting RISCv as being comparable to the latest round of fast cpus. It's a very interesting project, especially if you're running FPGAs, but not really a drop in replacement for anything much yet.

I also don't really like RISCv's explanation as to why they're safe. These exploits target the very theory behind branch prediction, speculative execution and cacheing. If I had to guess they might be safe because they don't do any of that yet, but their claim that they're safe because their architecture is crowd reviewable seems bold when nobody knew these basic theories could be abused this way until very recently.

 

[Klumpen]

Did I get this right, that the Raspberry PI is not only the cheapest but also the most secure computer now?

 

[Linux-SWAT]

Handling of CPU bugs disclosure 'incredibly bad': OpenBSD's de Raadt
https://www.itwire.com/security/813...losure-incredibly-bad-openbsd-s-de-raadt.html

 

[Linux-SWAT]

Intel CPUs Vulnerable To New 'BranchScope' Attack:

https://it.slashdot.org/story/18/03/27/1828237/intel-cpus-vulnerable-to-new-branchscope-attack

 

[levi]

Sounds like another good reason not to download and install random crap without checking checksums and reliabilty.

Edit: Otherwise known as 'stop internet javascript'.