News for hackers. Stuff that matters.
Re:Intel Publishes Microcode Patches, No Benchmarking or Com... by dspillett on Thursday August 23, 2018 @06:06AM (#17825975)
> and you won't have surprises

They seem to be getting less aggressive, but I've had my machine reboot with less than half an hour of notice. No notice before leaving the machine, return 30 minute later to find it rebooted. So "just mark every 2nd Tuesday of a month as patch day and never leave your machine(s) unattended on that day and you won't have surprises!".

I've also had (in a recent month) them reboot overnight, aborting long running processes that I had to clean up and restart, after explicitly checking for updates before starting those processes (none being found), and making sure my "active hours" were set such that it shouldn't restart.

Earlier this year I had a patch mid-cycle (not close to the normal patch Tuesday) that caused a reboot too. IIRC it was a flash-for-edge/ie update. An update for a feature I don't use/want and can't remove caused a "random" reboot at an unpredictable time. Ta muchly...

I understand MS wanting to get away from their desktop OS's insecure reputation which is in part caused by people never installing updates meaning that worms and other malware were able to run rampant relatively unchecked, but they seem rather wrong headed about how pushy to be in fixing that.

Re:Intel Publishes Microcode Patches, No Benchmarking or Com... by jenscow on Thursday August 23, 2018 @08:56AM (#17826817)
There had been many times I've started in the morning, expecting to work on the results of whatever process I left to run, only to be greeted with an empty desktop.

When I review the update settings, they're as negative as I can make them.

I shouldn't complain too much, sometimes it kindly starts Visual Studio for me, saving me 20 seconds.

It could have asked, or even warned that I'd be wasting my time setting up the nightly job, only for it to be cancelled midway through for little reason.

Basically, it's just a consumer OS, and shouldn't be used for actual work.

Re:Intel Publishes Microcode Patches, No Benchmarking or Com... by JoeAltmaier on Thursday August 23, 2018 @09:03AM (#17826871)
My favorite story about that: I worked in furnace optimization, giant electric arc furnaces that use half the electrical capacity of a small town generation plant. These things use 'pencil leads' the width of a child, meters long, that strike an electric spark an inch or two in diameter and 12 inches long, from the probe to the pile of recycled steel in the crucible. Melt it for new steel.

Anyway we had a PC running an optimization on the arc length, probe distance etc to get the best instantaneous coupling, trying to save electricity by putting the energy into the steel (to melt it) instead of burning up the probe, creating heat etc.

One morning the plant called, had run overnight but sometime in the late night the thing stopped adjusting, ran 20 minutes before they noticed without moving the probe or adjusting the current. Just sat there burning up carbon and making heat.

You can see where this was going. Investigated, and the PC had gone into 'power save' mode, suspended the app, gone dark. Leaving the probe at whatever setting it was at.

I estimated at the time, that the power wasted during those 20 minutes was more than all the electricity ever saved worldwide by Windows 'power save' feature. Yes, it would have been better had Microsoft Never Invented Power Save, than to have had that incident.

You can say it was our fault, guy installing didn't remember to disable power save. But still, people do things like that. I prefer to blame the computer.

Re:Intel Publishes Microcode Patches, No Benchmarking or Com... by api on Thursday August 23, 2018 @09:46AM (#17827175)
I love this story and it underscores something I've come to believe very strongly as an engineer:

Complexity is evil.

The benefits of adding complexity rarely outweigh the downsides, especially when the "embodied energy" of both creating and maintaining that complexity and the follow-on complexity it adds to other systems is considered. Making things a lot more complex to save energy is usually a wash (or worse) because of the energy you spend creating and maintaining complexity.

Complexity usually creeps into systems as a result of piecemeal solutions to problems, marketing driven feature-itis, or attempts by engineers to be overly clever and show off. The latter is incredibly common in IT and programming.

http://www.ariel.com.au/jokes/The_Evolution_of_a_Programmer....

Complexity is evil for efficiency, but it's even more evil for security. The number of states a system can enter is an exponential function of the number of variables and linkages in a system. More complex systems are just exponentially more likely to have vulnerabilities for unavoidable combinatorial reasons. The motive for complexity addition doesn't matter, meaning that complexity increases to mitigate security can easily backfire. Furthermore as systems become more complex they become too big to be analyzed, making it much more likely that major security issues are hiding in plain sight and waiting to be discovered. Black hats always have the advantage here because when you attack a system you get instant feedback about whether your attack worked, while security auditing offers no feedback as to whether or not you've closed all the holes.

Complexity tends to accumulate until systems collapse. Getting rid of it is very hard, since users/customers start depending on every feature and nothing can be removed without breaking something.

The x64 architecture seems to be teetering on the brink. AMD's architecture seems better but we'll see.

Re:Intel Publishes Microcode Patches, No Benchmarking or Com... by beavis2 on Thursday August 23, 2018 @09:27AM (#17827052)
I like those stories.

Although in this case, it's possible to disable power saving.

(or have they stopped that, too?)