News for hackers. Stuff that matters.
Re:Intel Issues Updates to Protect Systems from Security Exp... by anigbrowl on Thursday January 04, 2018 @03:43PM (#16073895)
AMD isn't vulnerable to Meltdown not because they foresaw this issue, but probably because they simply weren't as aggressive as Intel in allowing speculative execution

What do you mean by 'aggressive' here? Cause frankly, I think aggression isn't a good trait to be exploiting in business - it's not the same as competitiveness.

Is it 'they would have done this if they could but they didn't try hard enough', or is it 'they could have done this but didn't have the nerve to take the risk'?

In the latter case, I'd argue that a lack of willingness to trade off security against performance is a Good Thing in line with engineering ethics. In the former case, it seems like you're assuming business comeptition is always construed as a zero-sum game - is this correct?

Re:Intel Issues Updates to Protect Systems from Security Exp... by JamesBarney on Thursday January 04, 2018 @04:09PM (#16074105)
They weren't making a trade-off because it was not a known risk. No one had any reason to think that speculative jumps would lead to a large security hole.
Re:Intel Issues Updates to Protect Systems from Security Exp... by cookiecaper on Thursday January 04, 2018 @05:44PM (#16074815)
My understanding is that it was a known risk, see the various citations already provided throughout this thread. Meltdown is a bugged design decision because it failed to consider the consequences of asynchronously verifying permission for speculative executions that reach into kernel space, which allows the Spectre attack to affect kernel memory too. That's the limitation of the reach of the "Intel bug" as far as I know, the rest is generally applicable.

The Spectre attack is a side effect of performing speculative execution without wiping caches, something that was, until yesterday, an intentional and clearly-chosen industry design direction, standard across almost every commercial CPU produced in the last 20 years, despite the known risk of "theoretical" timing attacks.

The only reason for Intel to make the decisions that led them to be vulnerable to Meltdown was to sacrifice correctness/safety for performance, and failing to consider the potential side effects of that sacrifice (cache heat). They obviously made a bad risk tradeoff there (though I don't necessarily fault them).

AMD could definitely make the argument that Meltdown was an irresponsible "benchmark cheat" from Intel.

EDIT: And let me further clarify, ARM was "cheating" and doing the permission check asynchronously on some models too (i.e., some of their chips are also vulnerable to Spectre in Kernel-space aka Meltdown). It's not solely an Intel issue.

Re:Intel Issues Updates to Protect Systems from Security Exp... by wilun on Thursday January 04, 2018 @11:04PM (#16076432)
Speculating memory reference reads across security boundaries is not a trade-off (except if you can prove that you will not further act on them in any data dependant way that is observable). That's mostly common sense.

Spectre does not need that -- but OTOH is more difficult to exploit; it is in a whole different category. There is a reason they have different names.

Re:Intel Issues Updates to Protect Systems from Security Exp... by anigbrowl on Thursday January 04, 2018 @04:27PM (#16074239)
This seems to be subject to debate...