Bingo #kpti #intelbug
twitter.com
twitter.com
https://cyber.wtf/2017/07/28/negative-result-reading-kernel-... was published on 2017-07-28.
The pythonsweetness.tumblr.com post talks about patches being first posted in October (anyone have a link to the first public patch?).
https://lwn.net/Articles/738975/ was published on 2017-11-15.
https://lwn.net/SubscriberLink/741878/5c019c71457e0da6/ was published on 2017-12-20.
https://lkml.org/lkml/2017/12/27/2 was published on 2017-12-27.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... shows that Linus merged the patches on 2017-12-30.
https://lwn.net/Articles/742404/ was published on 2017-12-30.
http://pythonsweetness.tumblr.com/post/169166980422/the-myst..., which was the post that grabbed everyone's attention, was published on 2018-01-01.
Was the blog post on 2017-07-28 talking about the same vulnerability that has the world on fire today, or are there multiple issues going on?
edit: XSA-254 is about this, XSA-253 is still embargoed, so probably unrelated.
I'd love to someday see a book written about the history of this, starting from when the idea of speculative execution was first conceived decades ago.