News for hackers. Stuff that matters.
Re:Spectre/Meltdown Pits Transparency Against Liability by rrggrr on Thursday February 01, 2018 @02:05PM (#16284712)
The question that needs to be asked is this... were Intel subject to the same products liability laws as auto manufacturers or drug makers, would it make Meldown, Spectre and the ME vulnerabilities less likely? We know from other industries that products liability laws make for safer products, but we refuse to acknowledge that our CPU's are critical to safety because we don't pay much attention to how pervasively they are used, or the 2nd and 3rd order effects of flaws in the chips.

Its very possible, perhaps even likely, that Intel may profit more from the replacement of impacted chips, then it will lose settling various class action cases it faces. Its questionable if Intel's competition can or will grow manufacturing capacity such that Intel faces a real competitive threat.

It isn't that Intel is too big to be allowed to fail. Its that Intel is actually too big to fail; and that does not provide them the right incentives where product safety and quality is concerned in my opinion.

Re:Spectre/Meltdown Pits Transparency Against Liability by andmarios on Thursday February 01, 2018 @02:56PM (#16285277)
There are more questions that arise from this. For example if Intel were more vigilant and this lead to a 10x reduction in technological progress (CPU power has increased exponentially), how many lives would have been affected or even lost because cutting edge research that relies on super computers would happen 40 years from now?

If by making CPUs more secure, self-driving moves 30 years into the future, how many lives will this affect?

There is an old joke, about Bill Gates saying that if the automotive industry could move as fast as the computer industry, we would had $100 cars that do 1000 miles to the gallon and the GM chief answering that whilst these cars would exist, they would crash twice a day.

Re:Spectre/Meltdown Pits Transparency Against Liability by gnode on Thursday February 01, 2018 @03:06PM (#16285376)
I'm very happy for self driving cars to move 30 years into the future if that means not leaving their CPUs open to known vulnerabilities.
Re:Spectre/Meltdown Pits Transparency Against Liability by LeifCarrotson on Thursday February 01, 2018 @03:59PM (#16285828)
1.25 million people die in auto-related accidents each year. That's one person every 25 seconds.

If you are willing to delay the onset of self-driving cars by 30 years, that's a lot of blood. I agree there is a balance point that's not 1.25x30 million - some will still die after self-driving cars are introduced. There may even be some vulnerabilities exploited (but I strongly doubt that hacks will amount to anything approaching 1.25 million people per year - the media will hype up crashes where the self driving car or its security system was at fault as if it did, while ignoring the everyday fatal accidents with nothing except maybe an advisory to avoid that road on your morning commute). And as critical safety issues like maximum speed enforcement, drunk driving enforcement, helmets on motorcycles, seat belts, and child restraints trickle down into developing countries and older used cars, the number per year will - I hope - drop.

But one or two more have died somewhere since you started reading this comment. Still want to delay it?

Re:Spectre/Meltdown Pits Transparency Against Liability by perl4ever on Thursday February 01, 2018 @05:32PM (#16286583)
Everyone dies exactly once, no matter what they do, so I question whether driving causes any deaths at all. I think the comparison might need to be put in terms of quality adjusted person-years of life lost or something. People get tunnel vision when focused on optimizing a certain metric. If nobody was driving, how much would life expectancy go up?
Re:Spectre/Meltdown Pits Transparency Against Liability by LeifCarrotson on Monday February 05, 2018 @08:42AM (#16308655)
That only strengthens the argument.

People die from heart disease, cancer, respiratory failure, Alzheimer's, strokes etc. in old age. Reducing one of those factors would give few additional high-quality person-years of life. Auto accidents bring death to younger people who, in the absence of that catastrophe, would be expected to live many more years.

Re:Spectre/Meltdown Pits Transparency Against Liability by JoeAltmaier on Thursday February 01, 2018 @02:59PM (#16285306)
Vulnerabilities always get used. There's no way forward that doesn't include more vigilance.
Re:Spectre/Meltdown Pits Transparency Against Liability by andmarios on Friday February 02, 2018 @12:22PM (#16292253)
This is certainly true, the difficult part is to find a middle point between vigilance and sufficient progress rate.

Sometimes though, you can work in parallel. A consumer-grade CPU may for example be used in a airtight setup when increased security is needed.

Re:Spectre/Meltdown Pits Transparency Against Liability by the8472 on Thursday February 01, 2018 @03:14PM (#16285435)
> but we refuse to acknowledge that our CPU's are critical to safety because we don't pay much attention to how pervasively they are used

What kind of safety are we talking about? Nuclear power plants? Airplanes? Self-driving cars? If so, why would you be running untrusted, remote code on the CPUs of the critical components?

Sure, there occasionally are CPU bugs where the CPUs just randomly lock up, but we can defend against that with redundancy. The meltdown bug on the other hand requires malicious activity on the same chip, i.e. you need to offer an attacker a sandbox to run code on and then hope the sandbox holds and is properly resource-limited to not DoS your safety-critical system. It's a risk you shouldn't be taking in the first place.

And if we're just talking about credit card data well, we can easily compensate by moving to dedicated instances once such a problem becomes known, it's no worse than hypervisor escapes which become known every now and then.

Re:Spectre/Meltdown Pits Transparency Against Liability by SimonBiggs on Thursday February 01, 2018 @02:49PM (#16285205)
There would need to be two separate products. One covered by higher liability intended for use in critical systems, and the other under the standard liability.

I imagine that the higher liability CPU would likely be slow, old, and very very expensive. But that is the compromise required on behalf of the consumer.

Re:Spectre/Meltdown Pits Transparency Against Liability by the8472 on Thursday February 01, 2018 @03:18PM (#16285469)
That's pretty much what the military and satellite operators buy. Older, simpler CPUs manufactured on larger nodes, radiation-hardened to boot and with years of proven track record and bug fixes.

And then they buy two or three per system for redundancy.

Re:Spectre/Meltdown Pits Transparency Against Liability by monocasa on Thursday February 01, 2018 @03:40PM (#16285651)
And they pay for that too. A RAD750 was about $200,000 each according to wikipedia.
Re:Spectre/Meltdown Pits Transparency Against Liability by Dylan16807 on Friday February 02, 2018 @01:59PM (#16293221)
I'd say that the hardening is the overwhelming motivator there. That's the reason to be on a huge node. If you're not worried about radiation, you could shrink the same design, making it cheaper and faster and have larger safety margins all at the same time.
Re:Spectre/Meltdown Pits Transparency Against Liability by gnode on Thursday February 01, 2018 @03:04PM (#16285350)
What's a critical system? Is it okay for some things to have compromised security?
Re:Spectre/Meltdown Pits Transparency Against Liability by dfox on Thursday February 01, 2018 @05:21PM (#16286482)
Safety and security are two different things that are very often at odds with each other.
Re:Spectre/Meltdown Pits Transparency Against Liability by GuB-42 on Friday February 02, 2018 @11:26AM (#16291765)
It is not a question about safety, it is about security. To illustrate the difference, in an airport, safety is about properly maintaining planes and security is about keeping terrorists out.

If we exclude all potential issues except those related to meltdown and spectre, Intel chips are perfectly safe, the results are correct and there is no crash. It means that if they were safe to use in critical systems like engine control units, they still are.

Meltdown and spectre are security bugs, they are usually treated differently from safety problems like with cars and drugs.

Re:Spectre/Meltdown Pits Transparency Against Liability by samstave on Thursday February 01, 2018 @02:54PM (#16285259)
>The question that needs to be asked is this... were Intel subject to the same products liability laws as auto manufacturers or drug makers, would it make Meldown, Spectre and the ME vulnerabilities less likely?

This is such an important question -- and why we cant rely on gov sections like the FCC (ajit pai) to resolve these issues -- These are questions that will be critical to the evolution to the digital humanity which we shall be forever-more.

So we need to evolve to a next level meta thought to humanities destiny.... we are too focused only now by petty thinking.

Need to solve this problem.

Re:Spectre/Meltdown Pits Transparency Against Liability by CamperBob2 on Thursday February 01, 2018 @04:47PM (#16286234)
The question that needs to be asked is this... were Intel subject to the same products liability laws as auto manufacturers or drug makers, would it make Meldown, Spectre and the ME vulnerabilities less likely?

It would certainly make modern high-performance computing less likely.