Slashdot Mirror

There are three different attacks in the blog post by Google's Security team. The first one, for example, works as follows: it loads from a kernel memory address; this will generate an exception, but before the exception is generated (because the page permission check is delayed to improve performance) the subsequent instructions are executed speculatively. None of the following instructions will ever commit, but they can have a noticeable impact on the processor state, as follows: they speculatively execute a load, based on the contents of the position loaded from the kernel space. The load is issued (but not committed), what caches a given memory location. The specific location is based on one bit of the .

When the first load is detected to be illegal, the instructions in the pipeline are flushed, but (the following is the critical part) the cached address remains in L1. By timing a memory access to the corresponding address, they can infer one bit of the given kernel memory. By repeating this, they can subsequently infer the whole word, one bit at a time.

How can they solve this issue? I can only foresee two alternatives:
- Perform permission checks earlier in the pipeline, but this requires modifying the processor microarchitecture. AMD cores are not affected by this attack, so their uarch probably checks permissions before issuing the load.
- Completely or partially flush the contents of the cache after a processor miss-speculation. This is probably the solution being implemented in the patches being developed.

Note that miss-speculations are VERY frequent, since most of the execution of Out-of-Order processors is speculative to improve performance. This explains the VERY significant performance penalties caused by the patches.

Google did not test these vulnerabilities on any Zen based CPUs. They tested only on older processors:
"AMD FX(tm)-8320, AMD PRO A8-9600 R7"

https://googleprojectzero.blog...

Excelente sistema operativo ubuntu MundoNet

Well, I would really like to play on any Open tournament if some of this women would be playing in such conditions :)

http://egotvonline.com/2010/10/20/the-seven-sexiest-female-chess-players/

http://ajedrez.chess.com/forum/view/general/smart-and-sexy---top-10-prettiest-female-chess-players

http://chesscraft.blogspot.com.es/2011/09/14-most-beautiful-and-hottest-chess.html

But if you think there they have just choosen the better looking female players, let's look at the top 16 in the last Women World Chess Championship held just one week ago:

"The Women's World Championship begins" http://en.chessbase.com/post/the-women-s-world-championship-begins
"Closing ceremony: Mariya Muzychuk is crowned" http://en.chessbase.com/post/closing-ceremony-mariya-muzychuk-is-crowned

I am not going to comment about handsome men chessplayers, it's not my play field :)

Try opening a Linux file system with any version of Windows.

My linux file systems are on my linux machines which I access over the network, works fine. There are also drivers for accessing ext file systems on Windows if you want to plug the drive in directly.

How about this one, write a document in MS Office, save it in an open format such as .odt.

Why? Just send it as a word doc or a pdf or upload it to gdocs.

I can read Windows file systems, write to a .doc file, even install some Windows applications on my Linux box. If you prefer Windows, good for you. On this one though, your facts are backwards.

I can read Linux file systems, write to .odt (if for some reason i wanted to, using LibreOffice) on my Windows box so my facts are perfectly valid, you are just uneducated on the subject.

Actually that won't work since Google is enabling forward secrecy Knowing the key will not be enough. The NSA would need to have an actual proxy server between you and Google to monitor the traffic.

This duopoly. EU banks are always grumbling about how they want to start a new network to break the Visa/MC duopoly... too bad no one managed to do it other than tiny hardly accepted anywhere (in the EU) cards like Amex, otherwise you would be correct and we could not longer call it a duopoly. Just because there was Linux in the 90s, did not mean that Microsoft was not the undisputed monopoly at that time...

One gigantic warning label covering every square centimetre of San Francisco, listing all of the potential hazards you are exposed to by being anywhere near the place.

San Francisco: The City that Waits to Die"

can hardly be called "science"

Talking of stupid, anybody who takes this IPCC "draft" trolling seriously are being duped. The IPCC are climate change deniers, hiding behind a thin veil that can hardly be called "science"

The end game of the massive well funded disinformation campaign being to influence as many people as possible into taking strong climate change denial opinion. The problem is, the likes of Fox news and troll news like this one are succeeding very well in this aim, http://environment.yale.edu/climate/the-climate-note/>as this graph shows. Science and evidence be damned.

IPCC Disinformation campaign:

The slide above comes from the presentation of Hans von Storch to the InterAcademy Review of the IPCC, presented earlier this week in Montreal. The slide references the misrepresentation of the issue of disasters and climate change by the IPCC. von Storch is very clear in his views:

IPCC authors have decided to violate the mission of the IPCC, by presenting disinformation.

Not only did the IPCC misrepresent the science of disasters and climate change, but went so far as to issue a highly misleading press release to try to spin the issue and put an unprepared IPCC WG2 chair on the BBC to try to defend the undefensible. I was promised a response from the IPCC to my concerns, a response that has never been provided.

A former head of the IPCC, Robert Watson, says the following in the context of the 2035 glacier issue, but could be equally applied to the disaster issue:

To me the fundamental problem was that when the error was found it was handled in a totally and utterly atrocious manner.

The IAC Review of the IPCC is fully aware of this issue, and it will be interesting to see what their report says on the topic. Meantime, the IPCC is continuing its preparations for its next assessment in business-as-usual fashion.

Talking of stupid, anybody who takes this IPCC "draft" trolling seriously are being duped. The IPCC are climate change deniers, hiding behind a thin veil that can hardly be called "science"

The end game of the massive well funded disinformation campaign being to influence as many people as possible into taking strong climate change denial opinion. The problem is, the likes of Fox news and troll news like this one are succeeding very well in this aim, http://environment.yale.edu/climate/the-climate-note/>as this graph shows. Science and evidence be damned.

IPCC Disinformation campaign:

The slide above comes from the presentation of Hans von Storch to the InterAcademy Review of the IPCC, presented earlier this week in Montreal. The slide references the misrepresentation of the issue of disasters and climate change by the IPCC. von Storch is very clear in his views:

IPCC authors have decided to violate the mission of the IPCC, by presenting disinformation.

Not only did the IPCC misrepresent the science of disasters and climate change, but went so far as to issue a highly misleading press release to try to spin the issue and put an unprepared IPCC WG2 chair on the BBC to try to defend the undefensible. I was promised a response from the IPCC to my concerns, a response that has never been provided.

A former head of the IPCC, Robert Watson, says the following in the context of the 2035 glacier issue, but could be equally applied to the disaster issue:

To me the fundamental problem was that when the error was found it was handled in a totally and utterly atrocious manner.

The IAC Review of the IPCC is fully aware of this issue, and it will be interesting to see what their report says on the topic. Meantime, the IPCC is continuing its preparations for its next assessment in business-as-usual fashion.

If you don't mind text graphics, check http://xcomrl.blogspot.com.es

Hello, sorry for my English because I'm from Spain. I think we always look for the downside, the more positive. 2 years ago scientists discovered that many of the phones caused in the brain (waves) depression. I've had depression for example and it's funny but I have had two ways out of depression are: 1) STOP USING MOBILE PHONES. (I worked all day with cellphone) 2) Create a "blog" which specifically is this http://comosalirdeunadepresion.blogspot.com.es/ that although Spanish is in there you can find what to me has served out of a depression. But this I say, this very talking numbers ... but remember that the inhabitants of our planet are almost 10,000,000,000 and 15,000,000,000 supports our planet is, as we follow so soon existigiremos. Does the state know? Of course. So mobile manufactures to tons, create tsunamis (With HAARP), creates vaccines etc left sterile. It's just my humble opinion. A greeting David.

Can patch Windows on this: http://deepxw.blogspot.com.es/2009/04/universal-termsrvdll-patch.html to remove the Concurrent Remote Desktop sessions limit, and allow multi-user login in XP/Vista/W7