Hacker News Reader

Hacker News

Comment by tyingq | Hacker News Reader

Parent Full thread

tyingq

Discussed a couple of weeks ago based on a different article: https://news.ycombinator.com/item?id=27275707

Also see:

http://nieh.net/pubs/ieeesp2021_kvm.pdf (The paper)

https://microv.org/ (A website with more detail, Coq source, etc)

View on HN

Right and...

> Side-channel attacks [20],[21], [22], [23], [24], [25] are beyond the scope of the paper

If all current hardware (i.e. OOO and caches) is vulnerable to speculative side-channel attacks, how they dare to say that is secure? With current hardware, nothing is secure (full stop)

Most of the angst here seems to be around the phrase "provably secure". I don't think they meant that in the same sense that it's being received here. "Provably <xyz>" is just the common terminology in the theorem prover space.

Though they seem to be familiar enough with the real world to have known that would have sounded overly grandiose. I think what they really meant was something like "Provably Implements Whatever Security Boundaries That It Claims To".

> If all current hardware (i.e. OOO and caches) is vulnerable to speculative side-channel attacks, how they dare to say that is secure?

The software is provably secure. That doesn't mean a complete solution consisting of software and hardware is necessarily secure, and it has never meant that.

Then, what is the value of making the software secure if the hardware isn't?

The hardware issue is terrifying. And the worst part, it seems not possible to fix it without trowing away decades of performance enhancements. This epic screw-up of epic dimensions from computer architecture guys won't go away that easy.

Because software is the weak link, not the hardware. It only costs Zerodium $200k for a VMware virtual machine escape [1] which would allow GB/s data exfiltration in contrast to a Spectre attack which only has data rates on the order of KB/s [2]. Finding zero-days in mass deployed, foundational software like operating systems or hypervisors only costs on the order of $100k-$1M and occurs routinely. In contrast, finding vulnerabilities in hardware that breach confidentiality (read-protection) or integrity (write-protection) are so rare that it is a media event when one is discovered every decade or so of aggressive searching. Hardware is literally 100x harder to successfully attack than software. We would be lucky if we had systems that were only as secure as their hardware since they would be 100x better than the status quo.

[1] https://zerodium.com/program.html

[2] https://www.zdnet.com/article/google-this-spectre-proof-of-c...

While the hardware situation isn't ideal, secure software + vulnerable hardware is still better a better place to be in than vulnerable software + vulnerable hardware.

Is not an epic screw-up. More like 99.9% of compute is not done in adversarial untrusted sandboxes, so who cares if another process with a lot of work can extract data from another one.

You leave so much performance on the table if you demand cryptographically secure perf for everything. That means no caching, everything runs in fixed, worst case time, and the amount of work must be fixed as well so there is not any variation in power draw.

Here is a simpler solution - do not run untrusted code on your computer. It is just that easy™.

PS: I disable JavaScript by default in my browser, and manually whitelist exceptions, for the same reason. I also turned off Spectre mitigation on my workstation.

What are you using for JS whitelisting? I used to used uMatrix before it died.

uMatrix developer moved on to primarily work on uBlock Origin. It is a good successor.

I think some people do not like UBo because by default it is a little light on blocking so most websites just work. Well, you can configure it to block more things, and if you use uMatrix you already are willing to deal with the pain of this process.

Ah that's a shame. It isn't nearly as powerful as uMatrix which allows up to per-subdomain configuring of per-subdomain loaded images/js/styles/...

Reply on news.ycombinator.com