Hacker News Reader

Comment by georgeburdell | Hacker News Reader

I wonder what happened that Apple/ARM has implemented something similar at nearly the same time. https://security.apple.com/blog/memory-integrity-enforcement...

View on HN

Arm MTE is much older. Android already supported it with a limited number of devices: https://developer.android.com/ndk/guides/arm-mte

There is server hardware out there now that in theory can support MTE, but I don't know if there's commercial support for it. MTE needs to be set up by the firmware, it's not purely an OS/kernel matter.

GrapheneOS (hardened Android distribution) also has it enabled by default for the base OS and user-installed Apps that support it (you can also force it for all apps) on 8th Gen Google Pixels and newer

Interesting thread:

https://grapheneos.social/@GrapheneOS/113223437850603601

Intel already tried it once in 2019, failed and had to remove it.

https://en.wikipedia.org/wiki/Intel_MPX

Afaik Intel's first foray into this territory was their i960mx which ended up in F-22.

Even before then the iAPX432 had object capability security wrt its memory.

I remember playing with it and finding out it was slower than just manual bounds checks in front of every memory access.

The very first commercial system of this was done by Oracle in Solaris SPARC since 2015.

https://docs.oracle.com/en/operating-systems/solaris/oracle-...

Intel had a first attempt at this with MPX, but the design had flaws,

https://en.wikipedia.org/wiki/Intel_MPX

Then there is CHERI and the related ARM Morello,

https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

Apple isn't a first here, one first among general public.

Don't think it was any one thing so much as it makes a whole bunch of attacks more difficult - security is a perpetual arms race after all.

I agree it would’ve happened no matter what, it’s a very useful feature.

I do wonder if Apple‘s announcement that they started shipping it may have pushed them to announce this/agree to a standard earlier than they would have otherwise.

Reply on news.ycombinator.com