Slashdot Mirror
Intel Has a New Spectre and Meltdown Firmware Patch For You To Try Out (betanews.com)
Mark Wilson writes: The Spectre/Meltdown debacle continues to rumble on, and now the chip manufacturer has announced the availability of a new 'microcode solution' to the vulnerability. The updated firmware applies to 6th, 7th and 8th Generation Intel Core devices, and the release sees the company crossing its fingers and hoping that everything works out this time.
This is Intel's second attempt at patching the vulnerability, and this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job.
This is Intel's second attempt at patching the vulnerability, and this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job.
I'm waiting for the point when the Intel patch does less damage than Spectre and Meltdown. Are we there yet?
Not keen to be a guinea pig
You know what happens when someone claims they have a "final solution" to a problem.
"...this time around both the company and its customers will be praying that the fix for Skylake, Kaby Lake and Coffee Lake chips actually does the job."
I can understand the masses praying for a legitimate fix, but the company is praying this will work? Did they suddenly abandon the concept of testing prior to release?
I mean, it's not like Intel has to go digging to find a metric fuckton of affected hardware...
Who writes these taglines? This is clearly not a Meltdown patch at all, so it shouldn't be mentioned anywhere.
There was a campy, over-the-top parody TV show called "Sledge Hammer" back in the 80s... although even if you're old enough, you may not remember it since it wasn't exactly a roaring success. The "protagonist" (using that term loosely) was a gun-happy cop whose solution to everything involved using his gun. If someone was stealing a candy bar, he might shoot the candy bar out of the perp's hands, for instance. If an old lady missed her bus, he might shoot out the tires of the bus.
Anyway, right now Intel reminds me of the show's intro. Most of it just featured glamour shots of Sledge Hammer's gun... but, at the end, Sledge Hammer says "Trust me, I know what I'm doing", and he shoots - but the bullet miscarries, resulting in a (virtual) bullet hole on your TV screen.
That's Intel, in a nutshell.
#DeleteChrome
You can't fix Meltdown with a CPU patch.
Let me know how it goes, everyone! I'll see you all in therapy...
That patch is called "buy AMD or get a new Intel processor when they actually fix Meltdown and Spectre".
It's probably the only way to really fix a hardware bug like this one. It's entirely possible this is mainly Intel trying to save face, and the performance hit will be just as bad as KPTI or something.
the release sees the company crossing its fingers and hoping that everything works out this time
Intel has relationships with pretty much every computer OEM and cloud computing provider -- why do they need to cross their fingers and hope for the best when they can get their partners (who are just as motivated as Intel to have a usable solution) involved in large-scale tests?
Prayer is literally the least you can do.
CAPTCHA: Nonsense (seriously, good one, Slashdot)
Hey, Google only notified them in June and maybe they were going to get around to working on it after the holidays. And there are two new variants out this week that aren't considered, so be ready for the next round in a month or so as well.
You can't expect Intel to get these things done immediately, people! (the class action suits are going to love that they didn't fix it with six months' warning).
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Skylake launched Q3 2015. So Intel is pushing the patch for barely more than 2 years worth of product. What about the millions (billions?) of systems out there that were not replaced in the past two years? Are they going the same way of Android in the "well fuck, sucks to be you!" mentality of security because the device isn't the absolute latest and greatest? I'm thinking they only supported back that far is because there are Xeon-D CPUs that launched Q1 2018 with Skylake architecture, and Intel is all over that Xeon-D right now (this is what Facebook is now using)
Dear Intel,
Sock it to me.
Signed
Another Slaphappy Customer
Don't we have a chimp or a rabbit that we could test this stuff on first?
Have gnu, will travel.
get gallger to smash some intel chips
Does losing up to ~30% of your chip's speed mean more or less damage to you, to your usual workload, to the threat model you feel as better applying to your person?
So have we finally put to bed the finger pointing going on between Intel, Dell, and Redhat yet?
Thank you, official NSA statement.
Well
https://downloadcenter.intel.c...
finds only ancient, 2017 microcode version :-(
Remember that there are two groups with similar names, the Cardassians and the Kardashians. One group is vaguely reptilian, have large misshapen heads and an overblown and undeserved sense of superiority. The other group, of course, invaded Bajor.
Great civilizations have lived and died on false theories. Don't mess up mine with a few facts.
But more crashes!
You can gain performance and improve your security (even in the face of Meltdown) by turning off JavaScript (and ActiveX, and Flash, and Silverlight) in your browser.
Install a hosts file as well. I recommend this one. The problem with APK's hosts file is his engine is not signed by a trusted source. And several sites are mirroring it now, with no clear indication on modifications they may have made. Best not to risk your security with disreputable executables from ne'er-do-wells these days.
ZIP
Is Intel still shipping processors with these vulnerabilities?
If so, you have to ask "what the hell are they thinking"?
Would Ford or Chevy be allowed to keep selling a vehicle which was known to have defects that made it unroadworthy even before you drove it off the showroom floor?
As the defects are known, caveat emptor applies.
Moreover, there is a fix that the end user can apply as he sees fit.
If you are an end user of cloud service providers, then it is up to YOU to get a provider to make certain security guarantees in writing.
Comment removed based on user account deletion
"Sledge Hammer. The only guy that could make Dirty Harry look like a bleeding heart Liberalï." -- Unknown
Speaking of Intel. I can't remember... did Dirty Harry fire 5 shots or 5.999999999999?
fool me... you cant get fooled again!
I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell February 16 2017
(APK's work), I've flat out said it's good by BronsCon February 11 2016
his hosts program is actually pretty good by xenotransplant August 10 2015
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015
I like your host file system by Karmashock September 09 2015
I do use APK's host file on all my systems at home by OrangeTide December 01 2017
I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017
* See subject:... Get good reviews on my work via /. peers!
APK
P.S.=> It's better being ME vs. "CNN=Conde Nast Network FAKE NEWS" ArseHoleTECHNICA (lol) instead https://it.slashdot.org/comments.pl?sid=11776235&cid=56166549/
day.
Isn't all that is really needed is for certain instructions to either trigger the branch flush themselves while in mixed code, or, at the risk of damaging user mode realtime apps, randomly adjust the tsc/other performance timers when specific operations are triggered so that the cache timing doesn't align with the actual fetch?
Agile is the practice of building software without first figuring out what kind of software you need to build. It IS development by prayer - build something, anything, and then pray that it somehow related to the user's need.
Full speed ahead and let's pray the shields hold up!
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
The microcode signing keys for Pentium/PPro up, as well as the Redbooks for the microcode programming guides to be publicly released since they refuse to patch the older processors themselves.
The same concerns people have with the Intel ME apply to the microcode updates, only at least in the early days Intel limited access to that microcode information to a *VERY* small group of people, a half dozen by claim of someone involved at Intel at the time, but not in the hardware division.
Should have been:
Intel Has a New Spectre and Meltdown Firmware Patch And Wants You To Test It Because Intel Couldn't Be Arsed To Do Its Own Testing.