[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
mr meowski wrote: > > "New flaws and even more patches - "Spectre Next Generation" It was always going to be the case that further flaws were waiting to be found, sorry if I didn't mention it, I certainly spelt it out at work. It was also clear that some were unlikely to be fixable without new hardware. There are unmitigated hardware side channel attacks in most computer hardware, always has been, probably will be for the foreseeable. It is just not a big enough risk for most people to engineer against, versus say slowing the computer down. Just look how long it has taken to have a reasonable assurance that memory allocation calls won't give you other people's data left over in memory (Heartbleed anyone). In the case of these CPU based attacks most are only exploitable if you run arbitrary untrusted software on the same CPU as you do private stuff. The commonest case of this was JavaScript, and with the browsers reducing the precision of the JavaScript time resolution a lot of these are harder/impossible to exploit via JavaScript. These days the common case of sharing a CPU with untrusted parties is probably cloud based Infrastructure as a Service - e.g. AWS EC2, Azure, etc. If they are a concern the obvious approach is to reserve CPUs, so that it is in effect a private Cloud solution in a public cloud. I expect Amazon and Microsoft are big enough to have someone worrying about CPU allocation algorithms and other mitigations above CPU firmware fixes. I noticed, mentioning no names, one of the TLS termination devices we use allows me to switch off the Spectre mitigation stuff, and rightly so. If there is untrusted code running on that box we have lost, but the reduction in CPU performance still hurts. I've seen some academic exploits, but I largely treat most of this as dark magic, that is hard to exploit in the real world, and when you meet an attacker who can you are getting pwned anyway, probably by something much more mundane. -- The Mailing List for the Devon & Cornwall LUG https://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq