About the processor vulnerabilities Meltdown, Spectre, some articles

[TWPonKubuntu]

I've found too much information (TMI) about this on the net, so you get to do your own research. Here are some links to multiple articles:

https://lwn.net/Articles/742999/


https://lwn.net/Articles/742702/

Thanks to Linux Weekly News for these links. There are plenty of reader comments, so please feel free to wade through them at your leisure.

This could be the proverbial "tempest in a teapot" or it could be a serious problem. One factor which points to the later case is the report that an Intel CEO sold the legal maximum of his stock holdings just after learning about this and before it was publicly announced...

This is a general background article, from Ubuntu, which explains what these two vulnerabilities involve, and what you can (or cannot) do about them...

https://itsfoss.com/meltdown-spectre/

It appears that there is not much that the individual computer owner and user can do about this, except to wait for patches to be released...

[jglen490]

Exactly! And this is why it's so important not only to be aware of situations like this, but to always apply patches and updates as soon as they become available. Not only for your desktop and laptop machines, but also in the case of the recent wifi exploit, the rest of your network equipment.

Panic and paranoia are NOT allowed, awareness is required.

[TWPonKubuntu]

...
Panic and paranoia are NOT allowed, awareness is required.

Darn, Just when I was getting myself wound up for a Y2K type round of hype, apocalyptic sermons and retreat to my abacus warehouse. Guess that investment was premature...

[Snowhog]

my abacus warehouse.

Do you stock 32-bead and 64-bead abaci, or just 64-bead?

[TWPonKubuntu]

I couldn't afford the 64 bead hardware and the patent holder requires a NDAA to use the proprietary OS. I had figured on catering to the same people who bought the six pound satellite phones.

[GreyGeek]

That Intel CEO appears to have violated the laws against insider trading. He may be following Martha Stewart's path into Federal prison for several months or longer.

As far as those two vulnerabilities: call me a cynic. I believe they were well known to those gov spooks who spy on us continually. And, I have little doubt that those two holes are not the only ones added for the purpose of giving spooks access. Remember when the Feds wanted Apple to break into someone's phone and publically asked them, only to be told "no" by Apple. What did the Feds do? Contracted with an Israeli cyber team to break in, which they did. Every iOS device has a dedicated AES 256 crypto engine built into the DMA path between the flash storage and main system memory. In July of last year it was announced
https://www.theregister.co.uk/2017/0...conds_200_kit/
Maybe that's what the Israeli team used? Maybe they used a back door that Apple gave them in order to keep the heat off of Apple and still comply with the Feds, thus maintaining their security credibility. Regardless, AES 256 byte security is now useless.

My gpg keys are always 4096 bytes. If it really matters. And, no, I don't trust anything or anyone these days.

[gnomek]

https://insights.ubuntu.com/2018/01/...lnerabilities/

Ubuntu users of the 64-bit x86 architecture (aka, amd64) can expect updated kernels by the original January 9, 2018 coordinated release date, and sooner if possible. Updates will be available for:

Ubuntu 17.10 (Artful) — Linux 4.13 HWE
Ubuntu 16.04 LTS (Xenial) — Linux 4.4 (and 4.4 HWE)
Ubuntu 14.04 LTS (Trusty) — Linux 3.13
Ubuntu 12.04 ESM** (Precise) — Linux 3.2
Note that an Ubuntu Advantage license is required for the 12.04 ESM kernel update, as Ubuntu 12.04 LTS is past its end-of-life

[bendy]

Intel's PR team must be working overtime. Meltdown only really affects Intel CPUs, and the software fix will significantly slow down some workloads.

Spectra affects Intel, AMD and some ARM CPUs, but is harder to exploit.

Yet all of the news article in the mainstream press lump the 2 together and talk about vulnerabilities affecting Intel, AMD and ARM as if they are all the same. Intel seem desperate to obfuscate the fact they are by far the worst affected by this, and that the kernel fix will destroy their performance advantage over AMD (particularly on server and virtualisation workloads).

Meanwhile geeks in the know will be speccing AMD for their servers. I hope AMD has plenty of Epyc and Ryzen capacity...

[dequire]

Maybe these potential tragedies will end up being another push towards open source?

Why we need RISC-V

The RISC-V architecture is great because it is the only processor that has a completely open source instruction set, if you want to learn more check out their website. What’s an open source instruction set? In layman’s terms, it means that the way the processor moves around 1s and 0s is available for everyone to see. The advent of what is probably the worst security bug, Meltdown and Spectre, boiled down to a flaw in the instruction set of Intel’s processors. I don’t think anyone in the security field was completely shocked, after all, a speaker at a BlackHat conference demonstrated that there were unknown instructions in the x86 architecture, and that inevitably means there are hidden bugs, it was only a matter of time before a truly devastating bug was found, in our case it was Spectre and Meltdown.

[dequire]

Meanwhile geeks in the know will be speccing AMD for their servers. I hope AMD has plenty of Epyc and Ryzen capacity...

I agree this will certainly be a boon for AMD in the short run. Maybe longer, time will tell.

[dequire]

Nothing to see here

[TWPonKubuntu]

Hurray! 32 Bit Lives On!

Or was that an "oops" on the part of Intel?

Digital lobotomy as a "cure" is still lobotomy.

"I feel my mind going... Dave... Please stop... Dave..." - 2001, A Space Odyssey

[GreyGeek]

Some cartoonists are geniuses! That cartoonist is one of them.

[Snowhog]

Nothing to see here

[ATTACH=CONFIG]7313[/ATTACH]

An appropriate example of 'back engineering'.

[TWPonKubuntu]

Another article discussing these two vulnerabilities. It does a good job (IMO) of a layman's explanation and addresses what the Linux devs are doing about it, as of Jan. 8 2017.

http://www.zdnet.com/article/the-lin...tag=RSSbaffb68

Yes, it is from ZDNET, but read it anyway...