Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

[Kenmitch]

So how long before....

 

[LTC8K6]

Here they come:

http://www.securityweek.com/malware-exploiting-spectre-meltdown-flaws-emerges

It's too bad the flaws could not have been kept under cover for a couple more months to allow the patches to be worked out.

 

[coercitiv]

It's too bad the flaws could not have been kept under cover for a couple more months to allow the patches to be worked out.

Yeah, it's too bad they didn't keep under wraps for a few more months while independent researchers (as in other people than those at Google) were discovering the flaws before December 2017. People were onto this and were actively researching it.

We have no way of knowing if even state actors were aware of the flaws, yet you believe keeping most commercial entities in the dark would have been the better choice.

 

[Gideon]

It's too bad the flaws could not have been kept under cover for a couple more months to allow the patches to be worked out.

Why? From Your posts I understand that Intel's patches were working superbly and their handling of the issue could not have been possibly better in any way.

 

[LTC8K6]

Yeah, it's too bad they didn't keep under wraps for a few more months while independent researchers (as in other people than those at Google) were discovering the flaws before December 2017. People were onto this and were actively researching it.

We have no way of knowing if even state actors were aware of the flaws, yet you believe keeping most commercial entities in the dark would have been the better choice.

Yeah, I guess that's true. We don't know if anyone was ready to use the exploits.

 

[LTC8K6]

Why? From Your posts I understand that Intel's patches were working superbly and their handling of the issue could not have been possibly better in any way.

Yep, but there is always room for improvement.

And remember, I'm obligated to build a Ryzen system if Intel doesn't honor it's commitment to release fixed chips this year.

 

[formulav8]

AMD hit with two baseless class actions over Spectre/Meltdown

Lets get back to the lawyers. Both of them seem to take umbrage to the fact that AMD said the risk of a Type 2 attack was “near zero”. Then a bit over a week later said the same thing, just with different wording. They attribute this egregious act with AMD’s stock plummeting a massive $0.12 that day or a whopping .99%. Yes a near catastrophic 1% plunge was narrowly averted but they assert AMD stockholders were somehow severely damaged by AMD stating the same exact thing in two different ways. The horror.

 

[LTC8K6]

AMD’s current CPUs, Zen core based products, are completely immune to Type 3 aka Meltdown. AMD did the right thing architecturally and it prevented an unknown type of attack. Intel did the wrong thing, one of it’s many severe institutional failings around security, and is vulnerable to Meltdown. That said there is absolutely nothing wrong with with either AMD or Intel CPUs as far as Spectre is concerned, Meltdown is more of an opinion matter but AMD is completely immune to it.

In the case of Spectre and Meltdown, both side channels did not exist before Google’s Project Zero discovered them. It is new tech that just so happens to rip through software guards running on some CPUs. Those CPUs work exactly as described, sold, and promised, there are no errors. The software running on the CPUs can do things in a way that makes them Spectre vulnerable, and it can do things in a way that makes Spectre a moot point. Either way the CPU does the same thing, correctly, as described and sold.

 

[krumme]

Blah blah blah.
I just got like 25% less performance overnight for the server $ i pay.
Thats something i understand.

 

[DrMrLordX]

AMD hit with two baseless class actions over Spectre/Meltdown

Oh goody. AMD gets sued but Intel doesn't?

 

[LTC8K6]

Oh goody. AMD gets sued but Intel doesn't?

Intel's lawyers and marketing folks are more experienced at dodging lawyers...

I'm sure Intel must have been sued by now?

 

[coercitiv]

Those CPUs work exactly as described, sold, and promised, there are no errors. The software running on the CPUs can do things in a way that makes them Spectre vulnerable, and it can do things in a way that makes Spectre a moot point. Either way the CPU does the same thing, correctly, as described and sold.

All true except for any products launched after CPU vendors became aware of the problem. When they launched, they advertised performance numbers they knew would not hold up 6 months later.

 

[LTC8K6]

All true except for any products launched after CPU vendors became aware of the problem. When they launched, they advertised performance numbers they knew would not hold up 6 months later.

That would not be known until after patches had been created and tested, right? You wouldn't know the performance loss just on learning of the existence of the vulnerability.

 

[zinfamous]

Oh goody. AMD gets sued but Intel doesn't?

What a country!

 

[coercitiv]

You wouldn't know the performance loss just on learning of the existence of the vulnerability.

Exactly, so how can you honestly sell the new product making performance claims versus the competition, not knowing whether 6 months later your product will still be competitive?!

 

[formulav8]

I'm sure Intel must have been sued by now?

Yes, there are suits against Intel the last I heard.

 

[EXCellR8]

what's the latest on OS fixes? seems like every site I visit has different information about available updates.

InSpectre still states that my Intel machines are potentially unsafe, eh whatever

 

[moinmoin]

The latest rumor have it that Intel's faulty microcode was actually overheating the chips (by over 150% of the TDP) and that was what caused the "unexpected reboots". According to the rumor this actually caused hardware damage at AWS. via Fefe (German)

 

[Fanatical Meat]

What are the latest thoughts about this? I need to replace the Wife's machine in the near future, is AMD a safer route?
Machine is for regular home use, Facebook and Facebook games.

I'll likely be buying something dirt cheap or off lease.

 

[LTC8K6]

The latest rumor have it that Intel's faulty microcode was actually overheating the chips (by over 150% of the TDP) and that was what caused the "unexpected reboots". According to the rumor this actually caused hardware damage at AWS. via Fefe (German)

Why wouldn't they just thermal throttle to stay cool like they always do?

 

[LTC8K6]

What are the latest thoughts about this? I need to replace the Wife's machine in the near future, is AMD a safer route?
Machine is for regular home use, Facebook and Facebook games.

I'll likely be buying something dirt cheap or off lease.

You don't really have anything to worry about for home use.

 

[Markfw]

What are the latest thoughts about this? I need to replace the Wife's machine in the near future, is AMD a safer route?
Machine is for regular home use, Facebook and Facebook games.

I'll likely be buying something dirt cheap or off lease.

While AMD is probably safer (if its a Ryzen) I doubt you will find one off lease.

Get e new 1200, an ssd (you dont even need a hard drive for what she does) or wait until the 2200 and 2400 APU units come out,.

 

[LTC8K6]

While AMD is probably safer (if its a Ryzen) I doubt you will find one off lease.

Get e new 1200, an ssd (you dont even need a hard drive for what she does) or wait until the 2200 and 2400 APU units come out,.

Yeah, one of those new APUs seems perfect in this case. Supposed to hear about them for sure on the 12th or so.

 

[EXCellR8]

All affected CPU's that are currently on the market should have been pulled and/or offered at a substantially lower price--like liquidation prices. The 4790K is still almost $400 on newegg and the 3770K is even more!

Sandy Bridge and earlier should basically be given away. Goes for AMD chips too.

 

[LTC8K6]

All affected CPU's that are currently on the market should have been pulled and/or offered at a substantially lower price--like liquidation prices. The 4790K is still almost $400 on newegg and the 3770K is even more!

Sandy Bridge and earlier should basically be given away. Goes for AMD chips too.

Who would be giving them away?

Only a handful of the older desktop chips are even supported by Intel these days.
https://ark.intel.com/products/codename/29900/Sandy-Bridge#@desktop
4790K is discontinued, so Intel is not selling them.
https://ark.intel.com/products/codename/81246/Devils-Canyon
Most Haswell DT chips are also discontinued.
https://ark.intel.com/products/codename/42174/Haswell#@desktop

Why should the current sellers give the chips away?