We need to hold companies even more accountable than what they already are. 32 lawsuits is not enough, more like 320!
Should you be held accountable for choosing "weak" ciphers?
That would be up to the jury. For something like your scenario, as long as you're keeping up and using industry best practices, you almost certainly would have nothing to worry about. In fact, a case like that would likely be dismissed immediately by the judge before it ever went to trial.
What are "industry best practices" for that? There are like 3 companies which do this competitively at scale and each of them guard their methods like it's the Coca-Cola recipe.
Intel has has a long time to mitigate the issue. They didn't because it made their processors faster, and they chose profits over security.
Literally since 1995. There's no way Intel hasn't read this report from the NSA detailing how insecure the x86 platform is where they literally call out this exact feature as a security risk. This feature that was not accidental, but intentionally designed.
Why exactly are you blindly defending Intel, especially with such easily disprovable arguments?
The problem is data hitting the cache when it comes from an unreadable page. Meltdown looks like a bug in the cache hit logic because the page information is already in the tlb, and the fix is probably fairly trivial.
If the unreadabld page doesnt hit cache or is never mapped there in the first place, spectre can only read its own process.
It's just nobody put two and two together. This is actually mostly due to lack of public information in the processor manuals. Otherwise it's quite likely it would have been discovered 5-6 years ago at least.
Hey, maybe memory traffic sidebands for speculative execution are next. You can undo cache data changes, you cannot undo the slowing down of simultaneous other memory traffic. And who knows, maybe everyone was like "we cannot prevent all measurable side effects, so screw it #YOLO". And nobody can admit that due to liability issues. That seems quite likely to me because it doesn't involve hundreds of very smart experts missing an obvious problem.
Intel should have hired all these really smart people on Reddit and HN. Imagine how much safer and faster our processors would be!
It's a screw up in the most complicated devices humanity has ever designed. It's borderline magic that they even exist, let alone the political stability required for 50 years of constant gains in processing power per dollar.
But nevermind that, they're a bunch of "LOL #YOLO" about security types, we should sue them because your data center power went up and now our dumbass 'world changing app' to look at random kittens as a subscription service is no longer profitable!
I think humanity doesn't deserve scientists and engineers.
Security is absolutely neglected all over the place in IT, including in things I've worked on myself. It's too expensive.
I think specter should be fixed in software with some assistance from hardware, but overall with ooo, a process shouldn't expect privacy against itself.
They don't have to be done everywhere though. Just on js array accesses and the masking options seem better than the fencing option. It doesn't have to be done on every array access, and i many cases it probably isn't practically exploitable. We still don't have a working, real world exploit in js without assistance.
The speculation windows are in practice pretty small (10 instructions maybe), plus you have to find the memory you want to read, mistrain the branch predictor and flush the cpu cache between every read, etc... And do all this before that piece of memory you found moves or is overwritten.
> there goes the security of all current HTML/JS engines.
Pretty much. In places devs forget to protect against spectre there can be a possible exploit. Ooo causes similarly difficult to find issues with threading where the dev needs to think long and hard about how instructions hit the cpu, but we manage.