Three more data-leaking security holes found in Intel chips.

Phishfry said:
Here are their fake ISO certs.
Click to expand...
This is my understanding of ISO 9000 certification: It is not a certification assuring high quality of a product. It is a certification assuring that all product will be made with the same quality it possessed at the time of certification.
If later is discovered (as is the case here) that such product had a design flaw, we are assured that all of them have exactly that same flaw.
If what is discovered is that some later products do not have the same flaw, that it is enough reason to say the certificate is not deserved.
:)
 
It's incredibly frustrating how Windows determines prominency of CPU architectures; the whole Wintel thing is what got us here in the first place. There should be a mass exodus to a more reliable platform.
 
Here in the UK there are "two bit" operations with 9001 certification and it doesn't count for much. As with anything of this sort, if they pass the audits, then they get re-certified. If they fail them, they get so long to correct them. It's just a bit of bling to stick on headed paper which lines the pockets of consultants. Some companies won't deal with each other unless they have the 9001 certification, so it's kind of "viral" in a sense and of course win, win for those who make a living out of such things.

The main "get out" for Intel is that they can fix it, by issuing firmware patches. So long as this continues, they're safe enough - but there's also a "too big to fail" element here.
 
jpierri said:
This is my understanding of ISO 9000 certification: It is not a certification assuring high quality of a product. It is a certification assuring that all product will be made with the same quality it possessed at the time of certification.
Click to expand...
Well, it's difficult to understand, and even more difficult to explain. My understanding is that ISO 9000 just means that the company has a quality program, and that the quality program is documented, followed, and compliance is measured.

For example, ACME could have the following quality program: "We build roadrunner-killing devices intended to be used by coyotes, such as rockets, anvils, and hot air balloons. Our products have at least a 50% chance of exploding, and no more than a 20% chance of actually killing the coyote. We test this by giving just one sample of each of our products to the coyote, and record what happens when the cartoons play on prime-time TV." I think such a quality program would pass ISO 9000. It does not mean that the quality of the product is particularly good or bad, nor that it needs to be strictly reproducible.

Beastie7 said:
It's incredibly frustrating how Windows determines prominency of CPU architectures; the whole Wintel thing is what got us here in the first place.
Click to expand...
Sorry, but that's wrong. A majority of all Intel chips today is NOT used with Windows. Wintel is a buzzword from 10 or 20 years ago. Today, the dominant operating systems on the Intel platform (measured by revenue) are various Unix variants, such as Linux and MacOS. While there are still Windows desktops and laptops being sold, they are beginning to be not very relevant compared to the much larger number of servers, and mobile devices.
 
And now the serious question: Can you demonstrate that x86-64 CPUs from AMD, nor non-x86 CPUs (such as Power, Sparc or ARM) do not have these vulnerabilities?

Remember, the very first set of Spectre and Meltdown vulnerabilities also happened on AMD and IBM hardware. Today, the whole "finding CPU bugs" industry is focussed on Intel. That even makes sense, since Intel has an overwhelming market share on servers (which is where the larger number and the money is) and laptops/desktops. But as far as I know, the other CPU vendors and architectures have not done significantly better.

Here is an interesting thought experiment: Someone should take the first pipelined / speculative execution computers ever built (the IBM 360-91 mainframe and CDC 6600 supercomputer), and examine their architecture carefully for these security flaws. I'm going to bet that a thorough test would find that it had most of these problems already. But 50 years ago, people just didn't care: These machines were not connected to uncontrolled networks full of malicious actors, they only ran programs prepared by careful and responsible staff (typically on punched cards), and computer security wasn't a problem yet.

I'm tired of people dumping on Intel, just because they unreasonably hate "Wintel". There are many good reasons to hate Microsoft and Intel (and I even agree with many of those, as evidenced by the fact that I have chosen to not work for either company, in spite of ample opportunity). but as usual folks are letting their emotions cloud their judgement.
 
ralphbsz said:
Sorry, but that's wrong. A majority of all Intel chips today is NOT used with Windows. Wintel is a buzzword from 10 or 20 years ago. Today, the dominant operating systems on the Intel platform (measured by revenue) are various Unix variants, such as Linux and MacOS. While there are still Windows desktops and laptops being sold, they are beginning to be not very relevant compared to the much larger number of servers, and mobile devices.
Click to expand...

In context of the PC market, and it's influence on the enterprise. Yes, it is true.

Also, i'm not talking about current market trends, or what OS is more popular by revenue. I'm talking about the historical attribution of the Wintel alliance that put x86 in its prominency.
 
lebarondemerde said:
Three more data-leaking security holes found in Intel chips as designers swap security for speed
Apps, kernels, virtual machines, SGX, SMM at risk from attack
Click to expand...

Its features, not bugs.

Humans are notorious for manipulating information. Plausible deniability works both ways.
Solution? - easy... use military and secret services grade hardware and software ( make it available to everyone and cheap ). Because all citizens already paid for all development and manufacturing.

AND send to the lifelong jail all security sellers.
 
With the Spectre attack, this information can be used to, for example, leak information within a browser (such as saved passwords or cookies) to a malicious JavaScript. With Meltdown, an attack that builds on the same principles, this information can leak data within the kernel memory.

https://arstechnica.com/gadgets/201...e-and-meltdown-patches-will-hurt-performance/
Click to expand...

I followed a link in the article Phishfry posted to get there.

NoScript states on their homepage:

NoScript's unique whitelist based pre-emptive script blocking approach prevents exploitation of security vulnerabilities (known, such as Meltdown or Spectre, and even not known yet!) with no loss of functionality...

https://noscript.net/
Click to expand...

Am I just totally out in the weeds on this as a FreeBSD desktop user? Because if it's not as easily mitigated as it seems by disabling scripting and I'm missing something bigtime please don't hesitate to rake me over the coals and set me straight.
 
You must log in or register to reply here.
Back
Top