P4 2.2GHz Overclocked to 3.5GHz

GraveD sent linkage to a site explaining how a homemade nitrogen cooling system overclocked a P4 from 2.2Ghz to an incredible 3.5ghz. There's plenty of stuff to poke at over there. Update: 01/17 20:42 GMT by T : boaworm writes: "According to this paper, the Finnish geeks have successfully oveclocked a Pentium 4 to 3675 Mhz. They claim it is a new World Record, and it sure looks like they beaten another O/C'd Pentium 4 submitted earlier today on slashdot. (Summary in English in the end)."

Comments

Would this qualify under

[ViceClown]

Laws to Punish Insecure Software Vendors?

Security Myth

[Partisan01]

I think the flaw here was that Oracle claimed that no one can break into their software. There's always goign to be a way to get into software. It just might take a while. Unless some security team audited every single line of code over and over, which I can't imagine seeing the size of the software, there's goign to be some holes. To make a truly secure piece of software some performance is risked. From what I know of Oracle they pride themselves on performance. So my money says that they took care of the big holes, and missed a few of the smaller harder to exploit holes.

Nate Tobik

A Definition

[timdorr]

unbreakable
adj.

1. Impossible to break; able to withstand rough usage.
2. Able to withstand an attempt to break.

I dunno. That definition seems to contradict what's happened here.. =D

I'd like to know...

[Sawbones]

given the many discussions on /. of late re: full disclosure of security holes, partial disclosure, disclosure to the company only, etc - what does the crowd here think of the way these exploits have been handled? The story says the Litchfield has commented publicly and explicitly on the nature of one of the holes that already has a patch available, but that he's holding close the holes that have patches still under development.

I guess another question would be, while Oracle is by no means a small company, if the company name started with an M and ended with 'icrosoft' would we be demanding more information?

does anyone actually expose the DB to the world?

[zzzeek]

Had an argument about this awhile back.....the database listener services are not usually trusted as a secure thing for the outside world in my somewhat limited experience, there is always some kind of application layer as the public interface to these things (these days the outside world's interface is often HTTP based), particularly for services accessed over a WAN. How many people out there have oracle listening to an open port on the internet ?

Re:does anyone actually expose the DB to the world

[The Man]

Of course we would hope people would not expose the database to the world, but there are plenty of people who do. And more interestingly, the database is usually exposed to some internal networks (for example, a database for financials might sit well inside a firewall in the accounting department - on a corporate network). So there is still risk at least from people who can compromise firewalls, bypass poor security checks in applications, or from disgruntled employees.

The fact that defense in depth is a good idea does not justify allowing one of the layers to be weak. The defenses at every level should be as strong as possible, and that ideally means a bug-free app server and a bug-free database.

Nobody bothered to read the challenge...

[aralin]

Apparently nobody bothered to read the Oracle challenge. Oracle states that not the database itself, but the database in certain environment, properly configured and secured within the environment is unbreakable, which still is.

The only thing that this researcher proved is that in certain environments you can break in the system, which basicly holds true for every system.

No matter what, you can be sure that contrary to M$, these holes will be worked on 24/7 and fixed like yesterday. :)

Anyway, enjoy you uninformed, senseless bashing and flaming... trolls.

Re:Nobody bothered to read the challenge...

[dgoodman]

And of course those certain environments and configurations would be:

• Unplugged from any network
• Unplugged from any power source

Otherwise there will be some hole to exploit...one cannot expose features without also exposing some vulnerability (be it only social hacking)

Marketing at work, that's all.

[mystery_bowler]

The reality of it is that most DBAs, programmers and database developers in the working world scoffed at the ad campaign the moment it began. Sure, Oracle has a great product, but we all knew it wasn't bulletproof, no matter how may awards for "best of class security" it supposedly won.

The only real losers in this, other than organizations whose Oracle databases were victimized by a security flaw, were the corporate purchasers who were sold on the hype. They'll have to live with the fact that their DBMS isn't "unbreakable." Honestly, though, there are relatively few of those (none I can think of that are well-publicized, at least), as they are usually run on well locked-down *nix boxes.

It's not anything new. It's just agressive advertising. Some might argue that it's false advertising, but that's probably being a bit harsh. It's more like...overly boastful advertising.

Quote the Security Manager?

[Havokmon]

As if ANYONE on this site hasn't ever had to explain something that a some moron ^H^H^H^H^H^H manager said could or couldn't be done..

HIS boss is still the boss, wtf is he supposed to say?

It was a marketing ploy

[nzhavok]

It was a marketing ploy and any professional administator who looked at and said "wow, unbreakable, lets buy it" probably wasn't a professional at all.

It's not surprising that a system as complex as Oracle is going to have security flaws. However if you mistaken believed that Oracle had created the perfect piece of software, may I suggest you stow it away in the closet next to your Abdominizer and set of stay-sharp-steak-knives.

To paraphrase an old koan:

[mblase]

A software company said to the public, "Our product is unbreakable." The public replied, "No, you are not unbreakable."

Another software company said to the public, "Our product is not unbreakable." And the public replied, "You're right, you are not unbreakable."

Re:Weinberg's law of programming;

[Mr. Slippery]

One word: Pyramids

...which were the end result of centuries of evoluion in tomb design. The first pyramid to be built successfully is surrounded by ruins of decades of failed attempts.

Here's a more optimistic quote:

"Around computers it is difficult to find the correct unit of time to measure progress. Some cathedrals took a century to complete. Can you imagine the grandeur and scope of a program that would take as long?" -- Epigrams in Programming, ACM SIGPLAN Sept. 1982

Give us time. Meanwhile, be very wary of trusting anything important to software.

Liability

[JabberWokky]

I brought up the topic of Liability for software bugs with my Dad (he's a VP at one of the big banks). He replied that the current software companies would be "shot in the street". Now, I was confused until he explained: "Shot in the Street" simply means that the public and government would turn on them so hard legally that they would be driven out of business. Sure, some people would have legitimite grounds for a lawsuit, but most would be pressing legal action for their "piece of the pie". The companies (we were discussing MS in particular) wouldn't even have the *option* of beefing up QA and addressing the issues.

The more I've thought about this, the more likely it seems. And a key aspect to this is that my OS vendor, SuSE, and ilk (Red Hat, Mandrake, etc) would be nailed just as much as MS, except with less money in the bank, they would be killed much more swiftly. Now, two of those are outside of the USA, so it's not a direct correlation, but there are some serious ramifications to software liability that occur in as reactive a society as we have today.

Certainly this announcement would instantly have a dozen law firms seeking people running Oracle to launch a multi-billion dollar suit of some flavor. And while certainly not "unbreakable", and (IMO) a bit overpriced, Oracle being available is a Good Thing. Of course they have holes. I'm equally sure that they will likely address them quickly (Quickly being relative to the company involved). Introducing *sane* liability (at least in America) is going to be very difficult in a society that is making it neigh impossible to be a medical doctor, and is driving up medical costs due to the extensive CYA documentation (videotapes, extensive reports, etc) now required by industry insurance.

--
Evan "I'm pretty sure this is ontopic" E.

irony

[trb]

From the SecurityFocus article:

But Oracle chief security officer Mary Ann Davidson says the criticism is unfair. In an emailed response to Mullen's commentary, Davidson wrote that Oracle is giving the holes reported by Litchfield the "highest priority," but suggested that everything depends on what your definition of "unbreakable" is.

Rather than representing a literal claim that Oracle's products are impregnable, the campaign "speaks to" fourteen independent security evaluations that Oracle's database server passed, Davidson wrote, and "represents Oracle's commitment to a secure product lifecycle for our entire product suite."

So Oracle says it's fair that they assert that their software is unbreakable when it is not, but they say it's unfair when others criticize their misleading and errant claim. What's wrong with this picture?

Buffer Overflows Myth

[Tom7]

> Buffer overflow bugs can be prevented by a
> middle-school hacker. This is elementary stuff.
> Doesn't anybody believe in putting limits on
> characters? This is simple to prevent.

This is pure bullshit. Are the programmers of
Apache, IIS, Half-Life, Quake 3 Arena, Perl, SSHD, glibc, wu_ftpd, or BIND at the middle school level? Windows NT? How about the linux kernel? All have had buffer overflows, and I'll bet that many of them still do.

Unfortunately it is not always as simple as "putting limits on characters". The simple fact is that the C language is practically designed to make buffer overflow bugs easy to write and easy to exploit.

I agree with you that buffer overflows are serious, though. That's why I think it is ridiculous that we still write security-critical network software in C. Sometimes it is hard to get around, like in the linux kernel when you need to do hardware access (a microkernel architecture might make it easier to write certain parts in higher-level languages). You might argue that performance would be impacted (I don't think this is true, especially with network software where the network is the real bottleneck), but even this argument falls through for 99% of users, since most users are far from full utilization of their processor. However, almost all users *are* affected by security holes.

Re:Buffer Overflows Myth

[Vulture_]

The solution to this problem is quite simple, really -- write it all in Java instead. That way, if there's a buffer overflow, it's your JVM vendor's fault. ;)

You can't make a buffer overflow in Java. Trying to overflow an array will simply throw an ArrayIndexOutOfBoundsException. In most other cases, memory is allocated as needed. It's perfectly safe, for instance, to read a line of text (as in many plain-text protocols, like HTTP, IRC, etc):

Socket socket; // ... initialized elsewhere
BufferedReader reader = new BufferedReader(new InputStreamReader(socket.getInputStream()));
for (String s = reader.readLine(); s != null; s = reader.readLine())
System.out.println("Read from socket: " + s);
System.out.println("Socket closed!");

That code fragment reads everything that's received on a network socket, one line at a time, until the socket is closed. Note the absence of any opportunity for creating any buffer overflows...

Looks simple

[GigsVT]

It looks like you just pour the nitrogen into that big metal bucket that sits on the processor. This is more of a novelty than a usable system, I'd bet the nitrogen boils off in less than an hour.

Still, pretty amazing.

This strikes me as overkill...

[nherc]

Sure it's neat to see how cold and therefore fast you can make the latest chip run... for a whole couple minutes (until you run out of liquid gas coolant). What I find more interesting, are innovative solutions to cooling CPU's that are practical, stable and last more than one game of Quake.

Re:Neat, now how about my box...?

[ocelotbob]

I've seen a few sites here and there about overclocking non-x86 architechtures. To overclock one of the other architechtures is much more difficult, usually involving desoldering the clock chip. Also, most of the overclocking involves CPUs of a few generations prior; you don't overclock that brand new, $10,000 ultrasparc-III, unless you are clinically insane.

One of the few sites I've found where the guy has been insane enough to try overclocking a non PC is obsolyte.org. Even then, he overclocked a fairly old sun from back when they used 68k processors.

Although as a semi-related topic, you also don't see people talking about case mods on their non-PC systems. Am I the only one out there crazy enough to mod a case for a sun? Please tell me someone else has done it.

slow mobo

[cweber]

You can overclock all you want, but to have an all around fast system you need the appropriate data channels to feed data to this smoking hot CPU. Although bus standards and real, available PC motherboards have gotten a lot better in the past few years, a PC still tends to slow down terribly when given a huge data load to crunch on.

Personally, I still prefer purpose-built well balanced Unix workstations, despite their higher price tag. But then, I am a scientist and not a gamer.

Re:Speed is no longer important

[Rude Turnip]

/me raises his hand. Last year I would have agreed with you, however. When you start getting into spreadsheets with over 11,000 rows and a dozen or so fields in each row and the need to analyze all that data, one starts to appreciate having something faster than a Pentium I 200.

Re:Is 3.5 GHz enough?

[SirSlud]

More like, if all the software available on the x86 platform didn't depend on the chipset extentions rather than the raw architechture.

Don't confuse 'real life performance' with 'optimized for SSE/3DNOW/MMX' yadda yadda. Unfortuanetly, even though chips may be raw number crunching daemons (and Photoshop optimized for the G4 absolutely screams (maybe 33% better) over a faster clocked P4 in my first hand experience), and even though people may know that Mgz != speed, I think too many people still fail to remember that much of the percieved 'power' of certain chips come from compiler optmizations for that specific chip, not a lack of power in its competitors or an inability to turn FP and Int performance into 'real world' performance.

Re:whoopie

[Enrico Pulatzo]

Can you really say that its the consumer who will win when no consumer programs require much processing power over a P2 400 or so?

I mean, it's nice that intel and AMD can make such fast processors, but where's the bottleneck on overall performance nowadays? I'm willing to bet it's not in the chip.

I think we've reached a point in personal computing where the software is years behind the hardware. Only in the fields of gaming or professional rendering do we need such high performance machines.

My friend's parents recently purchased a 1.5 Ghz Pentium 4 for day to day bookkeeping!

Overclocking Pitfalls

[Rice-Pudding]

Speaking as someone who does digital design: I would *never* overclock a chip on a system that I wanted to be reliable unless I knew that the manufacturer was deliberately marketing their chips at a lower speed than they were capable of. There are just too many ways that this can bite you.

The main problem is that you just don't know when you have gone over the line. Overclocking might be suitable in most cases except that one critical path which doesn't get executed very much.

That being said, for getting the latest gaming system, overclock to your heart's content. Who cares if the game crashes once in a while?

Re:Japanese only

[Lxy]

I have little time to look at nothing more than a booklet of pretty pictures

If your time is so valuable, why do you read /. in the first place?

(OT) crazy moderation!

[A nonymous Coward]

Insightful? Informative? Did those two even follow the link? Presumably the Funny moderator did.

Sheeeet, I oughta donate all my karma to something usful, like advancements in cheese spreads.

That's great...

[Bunkryrass]

... now how about some faster hard drives? Seriously I sit in front of my P4 1.7, and my T-Bird 800, which both have extremely fast hardware, but I wait for the hard drive to load large graphics, save files, etc... When do we get 10,000 RPM Hard drives? What happened to Serial IDE? Wasn't that supposed to be the next big thing? A hard drive spinning at 7200 RPM, and transfer rates of 100 MB/s really are a huge bottleneck now. And don't say we don't need anything faster than that, I'm pretty sure we don't need anything faster than 2GHz for our home computers either... I don't have enough money for Fibre Channel... would be nice though.

Re:Compare it to an Athlon

[GauteL]

The P4 also has a less advanced FPU. When it comes to RC5 I guess there aren't as many clever little tricks you can use (like SSE), as the case is in 3d-graphics, so Athlon wins on brute force since it has a much better FPU.

Re:whoopie

[ToLu the Happy Furby]

So, this is probably how Intel demo'ed their 3.5GHz P4 last year. Shows how pointless the whole thing is, to be honest.

No: the 3.5GHz P4 Intel demoed at IDF last fall was air-cooled. On the other hand, it was certainly hand-picked from a special run of chips on a boutique process tuned to produce a few very high clocking chips at the expense of overall yield. Which, yes, shows how pointless the whole thing is, to be honest.

On the other hand, the fact that they are showing it off is an indication of where they're going. Intel showed of an (air-cooled) 2 GHz P4 at IDF fall '00, and launched the same part, not coincidentally, exactly at IDF fall '01. They showed a 3.5 GHz P4 at IDF fall '01, which means...?

No, they probably won't get one out quite so early (3.0 is more like it), but it'll be here around the end of the year. Incidentally, the top speed of an air-cooled hand-picked chip on a special process is probably more relevant to future clock scaling than that of a Liquid Nitrogen cooled off-the-shelf part, for the simple reason that the process will be tweaked to be more aggressive as time goes on, but the temperature is never going to magically drop to -196 deg C. (And yes, the difference matters, as lower temperatures attack different limiting factors for clock rates than tweaked processes do.)