Raspberry Pi? It was unaffected [https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...].

Meh. They got lucky because they didn’t use affected hardware due to valuing price over performance. It’s certainly not because of any brilliant insight or preventative measures they took.

You're joking, right? Raspberry pi is a toy computer — which is entirely related to why it was unaffected by speculation leaks. It does not fulfill the same needs as full size x86 chips.

The mitigation and litigation costs to the large players, even in the case of a successful defense, are surely larger than $250k.

For sure. But then you need somebody with vision, that will spend extra money on research so that these kinds of bugs don't happen. Then a new "smart" CEO comes and slashes budgets. Everybody is happy, they have the same sales but lower costs. Then, after years, the bugs are found. Now it's too late. You have to allocate money to mitigate and on top of that you have to spend more money on research and then spend a little on bug bounties. It's too late to go back now.

The problem is how do you recognize a truly good CEO vs. a CEO that lowers costs and makes everybody happy.

Market does not. CEOs are incentivized to please the markets and thus reduce investing at some point to prepare to exercise their stock options and sell. (There is plenty of discussion on what the exercise date should be and some people are pushing beyond 4 years for that reason.)

A lot of companies set a 4 year window for their CEOs. Funneling capital into research, displeases stock holders, as you show reduced earnings. Observe that markets care about steady earning growth; catching these things before they happen in general will not earn you points. That is a sad part of human psychology. Think as a metaphor that an average manager will ask how many bugs did this guy fix and not how many bugs and security issues did this guy caught or saved us from.

(See freaking Equifax -- https://www.marketwatch.com/investing/stock/efx -- they should have been out of business [my personal opinion]. Their stock price is fine. The only mistake of the CEO as far as SEC is concerned is he used inside information and sold.)

Market pressure will always drive outcomes, so you have to incentivize for the outcome you desire. It's far from clear how to bias such speculative (no pun intended) future costs against immediate returns even if you could identify a truly good CEO.

>Market pressure will always drive outcomes

Not necessary! Many CPU architectures and implementations were created by academic institutions, so nationalisation of this industry should be considered a possibility.

These bugs are probably most valuable against cloud providers (Where else do you get arbitrary code execution on a machine with other's valuable data on it?). Most cloud providers run Linux, not Microsoft (except Microsoft) and definitely not Apple.

The problem is that even if there is no practical exploit, you still have to patch. At our web company where there are no shared boxes we still spent untold resources upgrading kernels, rebooting servers, and then lost capacity due to performance degradations.

Infrastructure is normally patched and rebooted on a regular schedule, but when a bug like this hits and requires an off-cycle upgrade it's a big cost.

Microsoft does have a lot of Linux VMs https://azure.microsoft.com/en-us/services/virtual-machines/

What matters is the host OS, not the guest.

Microsoft also runs the second largest cloud provider in the world.

I know it is not a realistic alternative for many needs, but Intel's Atom cores are not affected by Meltdown or Spectre.

At least some of them are: https://security-center.intel.com/advisory.aspx?intelid=INTE...

Aaaaaw, come on! :(