Hacker News Reader

Comment by hackbinary | Hacker News Reader

I think what Intel is trying to say that this feature makes the chips insecure by design. It’s kind of like in Python where can get around the week protection for classes, methods, and variable to make them pseudo private by putting underscores in front of them.

View on HN

Except that these CPUs were not designed to be insecure. CPU makers spent decades marketing their architectures as able to support the implementation of secure operating systems. All of a sudden it is clear that this is not possible without heavy dose of software stopgaps. It is a fundamental flaw on CPU architecture that was not disclosed by these companies.

Neither was anyone else aware of these class of security issues with CPUs until recently.

Oh people were aware, we just neglected the issues IBM and other time sharing systems learned in the 70s.

If they were aware, why didn't anyone raise this issue till now?

The people that were aware were probably extracting value out of the fact that not everyone knew.

Could be not worth making a public stink, could be weaponizing the exploit, could be coordinated disclosure.

you mean all these security researchers kept it a secret for the last decade or two?

Until a few days, researchers couldn't prove that this was possible because there was no example of such exploits. But there was the idea that this could be possible. Also this doesn't mean that people with other interests didn't have their own versions of this exploit and kept it a secret.

Was there anything like this back then? (Speculative execution, L1 cache, branch prediction all in the same ISA?)

I'm scarred by the CISC - RISC wars, which were serious for my business at the time. So in a year I'm anticipating Open VMS I'm x64 , having a indelible memory of the memory space rings and system calls depending on explicit separation, I remember thinking to myself, well only four rings in Alpha are critical to VMS, and Intel Pentium has that many rings...so why don't they port straight to the main Intel platform? Is this leaking mode the reason?

Reply on news.ycombinator.com