CanaryLayout

I kid. The entire Zen class of AMD processors are vuln to Inception so you're not safe anywhere.

There is the "just use OS/2" strategy of the 1990s (referring to the period from 1995-2002 where you could sit happy in your niche OS that researchers and BHs were not targeting): in this case s390x probably has the same problem but no one is paying attention to it (other than a 3 letter agency, of course), so the chances of a payload reaching that arch are very close to zero.

The NES incorporated a chipset that buried an entire 6502 inside. You can get a Rockchip ARM chip for the price of a pizza that incorporates mixed cores on the die. Maybe the chipmakers don't NEED to solve every edge case until the end of time, but delegate side channel attack mitigations like this back to the chipgobblers (us).

Hear me out: Instead of making SMT an all-or-nothing pre oposition, we have "lousy cores" where untrusted code goes and make the customer "prove" it should get elevation to the cores with SMT?

I dont't want to clobber my chip that's running the mega-important payroll jobs where no one can load anything else on to the board under pain of death. However I would like to be forced into tagging what is safe to run SMT else I get stuck on the safer cores.

I might be an intern who has no idea what any of this stuff means and goes to Google it, then learn what this attack vector truly is. Then makes a plan on how to defend against it.

Am I crazy?

Performance sorta hinges on it. It could be that the cheaper way the chipmakers deal with it is to phase out the 4core set and push the cores on a die higher, and to do that--incorporate an older core design into dedicated cores for untrusted code.

This would also require changes at the OS-makers to tag thread forks for trusted and untrusted behavior.

Essentially: instead of shutting down SMT for the entire machine, make the customer "prove" the code is safe for elevation or else it gets scheduled as non-SMT.

shoulda bought the threadripper the intern recommended than buying that vulnshit your ISV recommended to you

You didn't have to think about this when you ran your code on your own chips; so it's your fault for backdooring the front end into the datacenter.

But now we have the 21st-century mainframe we like to call the cloud, where everything is shared. So I upload a container image with the vampire vuln intending to read all the activity on the host. Other customers jobs, the OS itself, even steal internal keys used at Amazon.

The motivation to do this kind of attack now is incalculable.

Since Applied Cryptograhy and everyday since publication it's been well-known and well-understood that NSA's never-ending efforts to weaken systems to make it easier for them to do their work wrecks havoc and costs billions to everyone else. Luckily their attempt to get everyone to adopt a PRNG that was broken on-purpose was thwarted.

But who's to say that any chipmaker gets bribed to backdoor their design to allow the reading of any page of RAM from any protection level doesn't happen? It would make their job super easy.

the inner columns are not great and you do need to get Z out of the same column as A to free up that SFB.

Interestingly, Spanish might be easier to optimize as a solitary language if the punctuation keys are moved away from the vowel cluster. You can get insanely-low SFB scores. Spanish is a higher-syllable density language with better spelling conventions than English.

What some of the alt-Spanish layouts have done is just take an EN-optimized layout and add diacritics (and Canaria is not an exception here either, it just restored some ergo sanity to Spanish vs. pushing Q and J to bad spots like most EN ergo layouts do). For those who work entirely in Spanish most of the time, EN-ergo layouts are not ideal.

apply application apprehension rapping snapping snooping

double letters stop the rolling action, and P is one of the biggest offenders. Putting P next to a vowel cluster does nothing for rolls. It makes more sense to swap to the other side of the board so while you are dealing with whatever P is doing, your other hand is teeing up the rolling keys that will start after P.

For instance: application. In Canaria your roll would look like this, with the keys being rolled in [brackets]

opp[ortun][ity]

Or, if you're slower:

opp[or][tuni][ty]

I've been QWERTY-free since 2012. I do the layout in firmware so I don't need to change the mapping in the OS. And I use QMK and ZMK and I have a travel board that's bluetooth.

This concern might have been real back on OS/2 and MS-DOS. Not now.

Let's go into why P is on the wrong side of the board in Workman (and in QWERTY, too). It is true that P is a vowel-hugging consonant. A distance analyzer that the creator of Workman used to look at travel distance would of course conclude that it should be one with the vowels.

But look how often P shows up as a double letter, which stops you from rolling the keys because of the double-strike: opposition oppression stopping appendage application applying appreciate --- there's a lot.

So in Workman the word PEOPLE is a painful SFB-fiesta, and that is a Top 200 word in English, and it does not feel good at all! That's because P needs to be opposite of the vowel cluster, not just because of PEOPLE, but because you need to use one hand to take care of the double-letter strike while the other hand is setting up the vowel cluster roll that is coming.

The QMK and ZMK projects let you do this in firmware. Programmable boards are going to stick around long after we're gone. At least until Elon sells his brain-to-USB HID.

You have an ISO keyboard. For those with ANSI boards (2 less keys) it's harder to do this. That's why in Canaria (audience is ES speakers in USA/MEX in particular) the grave/tilde key violates the principle of using it to add a grave mark and instead acts as an AltGr.

This allows you to strike the ` key with the left hand while hitting N quickly. Same for the vowels. The Ü is next to Ú so that it's all in the same cluster.

Some stats. Canary and Canaria are very high-roll layouts. This allows for lots of combos where 2-5 letters can be hit in a fast sweeping motion across the board (a "roll").

canaria (ASHTNEOI) (0 likes) w l y p k z j o u ; c r s t b f n e i a ' x v d g q m h / , .

MT-QUOTES: Alt: 22.56% Rol: 47.83% (In/Out: 21.07% | 26.76%) One: 2.21% (In/Out: 0.89% | 1.32%) Red: 3.16% (Bad: 0.08%)

  SFB: 1.22%
  SFS: 8.59%    (Red/Alt: 3.62% | 4.98%)

  LH/RH: 42.11% | 57.89%

------------------------

QWERTY (cmini) (0 likes) q w e r t y u i o p [ ] \ a s d f g h j k l ; ' z x c v b n m , . /

MT-QUOTES: Alt: 18.40% Rol: 37.59% (In/Out: 20.22% | 17.37%) One: 2.28% (In/Out: 1.02% | 1.26%) Red: 5.84% (Bad: 0.32%)

  SFB: 5.17%
  SFS: 12.18%    (Red/Alt: 6.43% | 5.75%)

  LH/RH: 54.65% | 45.35%

--------------------------------------------- Workman (cmini) (1 like) q d r w b j f u p ; a s h t g y n e o i ' z x m c v k l , . /

MT-QUOTES: Alt: 20.41% Rol: 42.34% (In/Out: 21.58% | 20.77%) One: 3.03% (In/Out: 1.52% | 1.51%) Red: 8.16% (Bad: 0.91%)

  SFB: 2.49%
  SFS: 7.73%    (Red/Alt: 2.68% | 5.05%)

  LH/RH: 48.32% | 51.68%

It's noted in the README.md Workman has a bad vowel cluster and one of the more annoying bigrams is LY.

The letter P in Workman is on the wrong side of the board. If you are making a vowel cluster (or close to one if you leave out A), then P goes opposite of where O and U go.

Microsoft's split board keyboard mostly only-addresses the wrists. It does not deal with redirects, SFBs and doesn't eliminate stretching (keyboards that reduce the number of keys help with that).

QWERTY is an alternating layout. It wasn't designed for comfort. It was designed in the 19th century for a particular purpose that no longer exists (how many documents do you need to prepare that require a non-electric typewriter?)

Changing your keyboard layout does play a big role in relieving hand pain than just shelling out money for boards.

Even Zoomers are running away from their own software.

Instead of counting distance like Workman does (and totally ignoring weird+painful finger stretches), good `ol community-debate among layout experts, who have collectively switched layouts thousands of times, was done to make Canary.

Introducing Canaria (spanish for "canary"). This version moves the J to make it faster to type in Spanish, without sacrificing English speed or ergonomics.

It's rare for an ergo key layout to be good in two languages. This one is.