Re:Downfall Attacks
by yyyk on Tuesday August 08, 2023 @07:58PM
(#37057082)
The chipmakers don't have an incentive to look too hard for speculation security issues beyond a bit of PR. If they succeed, they lose money and marketshare, while their 'insecure' opponents gain and at most patches later. And in fairness, a lot of these bugs are rather theoretical. Until buyers take these bugs much more seriously, this isn't going to change.
[ Parent
| on HN ]
Re:Downfall Attacks
by peddling-brink on Tuesday August 08, 2023 @10:11PM
(#37057955)
Clouds take these vulns seriously, and have a lot to lose, and have deep wallets. I'd be surprised if this topic didn't come up when large purchases are discussed.
Not that there are many alternatives..
Re:Downfall Attacks
by ComodoHacker on Tuesday August 08, 2023 @11:11PM
(#37058291)
And this flaw was found by researcher working for a cloud vendor. I wouldn't be surprised if they already have some special long-term agreements.
Big clouds have the exact same incentive issue - if a customer is really paranoid, the customer can pay the cloud extra and ensure their own exclusive infra. For regular users, the clouds can mitigate a bit at scale (but not care much about this in practice, it's not as important as cheaper faster processors).