Re:ZombieLoad: Cross Privilege-Boundary Data Leakage on Inte...
by XorNot on Tuesday May 14, 2019 @06:27PM
(#19914433)
Except that's objectively wrong - x86 virtualization breakouts have been extremely rare in practice, and fixable till recently.
The new class of attacks we now see target any type of shared code execution environment. OpenBSD is as vulnerable to this as anything else.
Re:ZombieLoad: Cross Privilege-Boundary Data Leakage on Inte...
by astrange on Tuesday May 14, 2019 @11:36PM
(#19916198)
OpenBSD disables hyperthreading, doesn't it? That's a smart defense against at least one of today's attacks. Doesn't help if you're a VM guest, but does if you're the host.
Re:ZombieLoad: Cross Privilege-Boundary Data Leakage on Inte...
by redrabbyte on Wednesday May 15, 2019 @07:58PM
(#19924957)
there's a foreshadow-ng variant specifically for vms, and it's arguably the worst
Re:ZombieLoad: Cross Privilege-Boundary Data Leakage on Inte...
by Gibbon1 on Tuesday May 14, 2019 @05:40PM
(#19914144)
> examples: "Rust/Java gives you security"
Reminds me a friend who worked on Javascript in the early days said it was the only thing that had any hope of providing minimal security at the time. Because Windows 3.1 and 95 +0x86 was a security trashfire.
The only hardline view on security you'll encounter in the wild is "security is practical in our computational environments"[1]. Only half-joking here.
My reading of Theo's quote is merely "the combination of x86/IA32/AMD64 and virtualization gives little to no factual security benefits, and plenty of pitfals".
I don't see Theo as being a hardliner about security, just meticulous about good engineering practices - as per OpenBSD's usual standards - and facing the problems & risks as they are.
[1] examples: "Rust/Java gives you security", "shortlisting the only allowed actions by end-user application gives you security", "hardcore firewalls give you security", "virtualization gives you security", "advanced architectures like Burroughs' give you security".