Hacker News Reader

Comment by mdspan | Hacker News Reader

I think until something hardware-based like CHERI becomes widely deployed (which seems extremely unlikely in the near to mid term given), we're going to keep seeing VM escape CVEs pop up indefinitely.

View on HN

Because we've never encountered hardware bugs…

Critical hardware bugs occur an order of magnitude less frequently than critical hypervisor/kernel bugs, which is why they always make the news. In general, they're also more difficult to exploit. We haven't seen any serious spectre or meltdown malware in the wild almost a decade later.

But when they get discovered the only solution is to redesign the thing and throw away all of the hardware, with no mitigation strategy in between.

Some might prefer issues that can be fixed instantly and cheap to issues that will require years and millions to be fixed.

You seem to be arguing on the basis that people are throwing away the software security layers, when the discussion so far has been about hardening the software security layers even more with secure hardware.

This is the nirvana fallacy in action. Because you cannot imagine a world with perfect hardware, you think hardware that catches 99.9% of security bugs is worthless.

You seem to be discarding budget problems. Yes you can do a lot more things if you have unlimited budget, but that is rarely the case. So most solutions won't be implemented if they aren't also relatively inexpensive.

Reply on news.ycombinator.com