The Next Vulnerability: Looking Back on Meltdown and Spectre One Year Later

Re:The Next Vulnerability: Looking Back on Meltdown and Spec... by deepnotderp on Saturday February 09, 2019 @01:47PM (#19123871)

The basics of the spectre exploit were discoverable 20 years ago and run deep, to the very core of branch speculation. This is nothing but marketing for risc-v and rambus, there's no magic in risc-v that prevents spectre except that the ecosystem is so primitive that they barely have any speculative processors...

We could have found the spectre exploit 20 years ago. To me, the fact that we didn't until now is maybe the most interesting thing.

[ Parent | on HN ]

Re:The Next Vulnerability: Looking Back on Meltdown and Spec... by ufo on Saturday February 09, 2019 @02:53PM (#19124210)

I think one of the reasons is that nowadays we run a lot more untrusted code on top of our hardware, due to things like Javascript and virtualization. Meltdown and Spectre would not be as dangerous 20 years ago.

[ Parent | on HN ]

Re:The Next Vulnerability: Looking Back on Meltdown and Spec... by blattimwind on Saturday February 09, 2019 @04:08PM (#19124643)

> The basics of the spectre exploit were discoverable 20 years ago and run deep, to the very core of branch speculation.

Some aspects of these were known 20 years ago.

http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf section VI.E)

[ Parent | on HN ]

Re:The Next Vulnerability: Looking Back on Meltdown and Spec... by userbinator on Saturday February 09, 2019 @02:27PM (#19124081)

To me, the fact that we didn't until now is maybe the most interesting thing.

I suspect it's because there was still plenty of far simpler and more obvious exploits to look at.

[ Parent | on HN ]

Re:The Next Vulnerability: Looking Back on Meltdown and Spec... by segfaultbuserr on Saturday February 09, 2019 @09:55PM (#19126124)

> To me, the fact that we didn't until now is maybe the most interesting thing.

Back then, people were smashing the stack for fun and profit. Think about it! Executable stack! No canary! No ASLR! Can't be more fun.

[ Parent | on HN ]