GP is right. Some tech journalist made a flawed deduction and the resulting entirely false story spread virally, even to slashdot. According to their official statement, Nvidia is simply updating its GPU drivers to help mitigate the CPU security issue, a normal and expected move that will be followed by many software vendors since spectre (specifically CVE-2017-5753) actually represents a new class of security vulnerabilities - like "buffer over-read" but different.
In answer to your post, while GPUs do support branching, they don't engage in branch prediction, which makes them immune. In simple terms, superscalar CPUs process data in a "scalar" fashion, but use all kinds of tricks (like speculative execution) to perform more ops per cycle than would be possible for an equivalent scalar design (hence "super"). While superscalar designs fulfill strong market pressure for high per-thread performance, they comes at the cost of using a lot of silicon (and power). Also, one of these "superscalar tricks" just now has turned out too tricky for its own good.
In contrast, GPUs take a whole different approach in getting around the inherent bottleneck of a scalar design: they perform simple operations on a whole array worth of data at once, and can be seen as a cluster of hundreds of simplified scalar CPUs running in parallel (to give an example of "simplified": they commonly share instruction decoding logic to some extent). The advantage of this approach is that you can use silicon for actual computations that would otherwise be "wasted" on "superscalar tricks", which is why GPUs have such phenomenal computational throughput per unit of power consumption compared to CPUs. The disadvantage is that your workload needs to be optimized for this design, which isn't always possible, leave alone easy. They're great for graphic rendering, though.;)
Anyhow, given the above, you can see that some would argue that going superscalar would defeat the whole point of a GPU living alongside a CPU in the same box...
There definitely is one - its cost is what those rightwing types are continuously whining about. You simply fell through one if its many holes. That's why it might need to be propped up a bit.
I have lived for several years in both the US and in one of those scary Social Democracies in Northwestern Europe. On both occasions, it was in cities with relatively large numbers of impoverished people (to local standards) and relatively high crime rates (also to local standards). The "to local standards" is important, because the differences were stark. It even affects the quality of life of middle-class people living in the same place.
Now, what are your experiences, apart form having read Breitbart, watched Fox News, and perhaps gone on vacation abroad a few times? If the answer is "none", who's being close-minded here?
Yes, from a purely short-sighted insulary money-centered point of view, it is a bit of a paradox. To make it even more tragicomical, the paradox exists on both sides: there's a large population that vehemently votes against anything that would strengthen social safety net, even though they are the ones who would benefit from it most.
I believe the paradoxical state of things was exactly the point GP was trying to make. To put it crudely: those who are mature enough to rise above the short-sighted POV are doomed to support those who keep on trying to shoot themselves in the feet.
Variant 2 is being patched in compilers. Both gcc and clang are working on patches (that might already be released?) that avoid any speculative execution of indirect branching. Using a trick documented by google to patch the stack with the destination address, and then return. So now we just have to recompile *everything* that has access to privileged / sensitive memory contents to hopefully prevent attackers doing anything useful with branch poisoning. Of course there will be a performance hit, as no indirect branches can be correctly predicted.
Thanks a lot for the reviewing and corrections! I hope not only I but the/. community at large will get some benefit out of this exercise.
I guess I did get a bit lazy with verifying statements about ARM. Also, I'm surprised on a somewhat more fundamental level that it's so badly affected, so some confirmation bias might have been at play. If a lot of the same issues turn up in a completely different architecture, then Intel's "hard-to-foresee consequences of logical design decisions" attitude might have some merit after all.
Though that doesn't excuse their "conflation smoke screen". They deserve the class action lawsuit for that alone.
He's also dead right in that Intel has been mixing up the two issues, Meltdown and Spectre, deliberately, so they could tell everyone that it wasn't just Intel that was affected, and they also gave the impression that Spectre had been fixed when it was Meltdown that had been mitigated - with a patch that creates unacceptable performance problems, to a lesser or a greater extent.
This, in spades. While Theo De Raadt is not my favorite IT personality, the mixing together of the issues (actually 3 of them!) has made it exceedingly hard for someone who isn't familiar with the inner working of modern CPU architectures to get the story straight, and Mr. De Raadt gets kudos for calling them out on it.
The following is what I could infer from what I found online. I'm almost certain a good portion of it is WRONG, and I hope the more knowledgeable part of the/. crowd will help me out by correcting it. (No, I'm not being lazy - just stretched to the limit of my understanding of the primary sources, yet desperate to gain some working understanding beyond the "it's hard to explain but you should apply patches" advice found everywhere on the internet.)
There are three separate but somewhat related issues:
Variant 3 is a true bug by any definition. It was named "meltdown" and is an Intel exclusive - AMD and ARM are not affected. If an attacker succeeds to run a malicious binary on an affected system, they can read kernel memory, including juicy secrets like passwords and decription keys. To put this into perspective, this is very nearly as bad as a local privilege escalation. And to put that into perspective, local privilege escalations are so common that there's a mantra in security: if a sufficiently skilled adversary gains "arbitrary code execution", it's virtually "game over" and you can go scrub your HDD. Nevertheless, the aforementioned "sufficiently skilled" bar lies quite high and may not be met by a lot of common threats (especially the automated ones). So, from a defense-in-depth perspective, the only sane advise is "patch your system now". The big news is that patching will come with a performance impact that is proportional with how frequently a process calls the kernel. A process that simply allocates a big chunk of memory, loads data into it, and starts chewing on that (think stuff like compression, crypto mining, scientific computation,...) will not feel much impact, while databases generally will.
Variant 1, IF I understand correctly, allows an attacker to feed a non-buggy process carefully crafted input that tricks it into leaking data into memory space that is owned by the process in question, but not in use by it. The bad news here is that all CPUs (including AMD and ARM) are vulnerable and there's no way to patch it system-wide. One could argue that this is not a huge deal in and by itself because if the process and the system have no other bugs, the data could never be retrieved. However, it is apparently possible on certain browsers to make JavaScript read data from the "not-in-use" memory locations (which would be a feature for a "system" language like C, but I would classify it as a bug for a high-level interpreted language such as JavaScript). Given that a browser handles sensitive data (passwords), this is potentially devastating. Fortunately, it is easily mitigated by the fact that the leaked data doesn't live long by virtue of it physically only residing in the CPU cache and not the actual memory. The attack therefore relies on precise timing, and by decreasing the precision of the timing mechanisms that are available in JavaScript, browser manufacturers can put a stopgap into th
Errm... there exists such thing as creativity in STEM fields too. Your "working as a barista in Los Angeles" argument doesn't really apply to the premise of TFA. Also, it's not about "writer's block", but about the fact that frantically churning away at some deadline takes away all breathing room needed to come up with / try out some out-of-the box solution that may turn out to be vastly more opportune in the long run. RTFA, sheesh.
Thank you for thoroughly showcasing the misinformation I was talking about. I rest my case.
Unfortunately no time for debunking all the tired old talking point. Some basic (reasonably unbiased) reading on the subject should do the trick, though.
That would only be true in American speak, where decades of anti-socialist brainwashing have successfully led to an almost-universal conflation of "socialist" and "communist". In most of the rest of the world, "socialism" (or more precisely "social democracy", though that doesn't roll off the tongue as well) is pretty much synonym to "strong welfare", and something different from "communism", which would refer to one particular, notoriously misguided attempt at implementing socialism.
<Insert most common counterargument>
Yes, the Soviet Union called itself "Socialist". North Korea also calls itself Democratic... Neither gets the monopoly on That Word.
Tiny nitpick: if you're using "ssh -CX", you're also having the compression benefit. For a lot of applications, it actually speeds up X11 forwarding quite a bit (possibly because of what you just said; bitmaps images of desktop applications are often very compressible).
I find buying used (nontrivial) electronics (and using other people's electronics) icky. It's the cybersecurity equivalent of donning a piece of underwear that was found at the roadside. One could argue "nothing a good round of disinfection won't fix", but that gets a lot more complicated than "wash hot".
The electrical fire's intensity damaged two substations serving the airport, including the airport's "redundant system" that should have provided backup power, Reed said.
Am I the only one who finds it strange that two supposedly redundant systems are housed under the same roof, or at least so close together that both of them can be damaged by the same fire? At my last employer, we duplicated stuff that is far less critical over 2 buildings located at a good distance from each other...
Sure, but this is a relatively large-scale crowdsourced operation. It takes a peculiarly twisted individual to spew that much BS all by himself. It's so bad that it has become a newsworthy rarity for a significant truth to come out of that corner.
Think of it, most people willfully avoid being caught spewing patently wrong information in public for reasons such as dignity, self-esteem, standing with others,...
I guess you flunked out of high school biology class. Zygote, embryo, and fetus are legitimate scientific terms.
I wonder if whoosh is also a scientific term.
Yeah, it's for humor (often sarcasm) that went over someone's head:) What we have here is more a complete (deliberate or otherwise) failure to read the first 5 words of the post one is replying to.
Topic. Cellphone radiation. Not Mashiki's character. Are you a closeted obsessed fan of his or something? Either way, you're free to submit a story about Mashiki's character, and see if anyone other than you feels it's newsworthy. Until then, try to stay on topic.
Yes, he is toxic, vile, and despicable
Be that as it may, this is a discussion about a predefined topic, and he might have something interesting to say about it. Closing your ears and singing an unrelated song makes you "one of them".
I can't find much actual scientific information in any of the links in the summary. Can someone please provide a link to the actual findings of which mention is made? (Yeah, I'm too lazy to do it myself.) Or has the word "findings" taken on an "alternative" meaning?
Slashdot Mirror
True - this gets very close to the cyber-equivalent of a protection racket.
I just stumbled upon a very nice explanation on why GPUs don't have branch predictors that is far more rigorous (although also somewhat more technical) than what I wrote.
Oh wow you're right, that's nasty (even if entirely coincidental).
GP is right. Some tech journalist made a flawed deduction and the resulting entirely false story spread virally, even to slashdot. According to their official statement, Nvidia is simply updating its GPU drivers to help mitigate the CPU security issue, a normal and expected move that will be followed by many software vendors since spectre (specifically CVE-2017-5753) actually represents a new class of security vulnerabilities - like "buffer over-read" but different.
In answer to your post, while GPUs do support branching, they don't engage in branch prediction, which makes them immune. In simple terms, superscalar CPUs process data in a "scalar" fashion, but use all kinds of tricks (like speculative execution) to perform more ops per cycle than would be possible for an equivalent scalar design (hence "super"). While superscalar designs fulfill strong market pressure for high per-thread performance, they comes at the cost of using a lot of silicon (and power). Also, one of these "superscalar tricks" just now has turned out too tricky for its own good.
In contrast, GPUs take a whole different approach in getting around the inherent bottleneck of a scalar design: they perform simple operations on a whole array worth of data at once, and can be seen as a cluster of hundreds of simplified scalar CPUs running in parallel (to give an example of "simplified": they commonly share instruction decoding logic to some extent). The advantage of this approach is that you can use silicon for actual computations that would otherwise be "wasted" on "superscalar tricks", which is why GPUs have such phenomenal computational throughput per unit of power consumption compared to CPUs. The disadvantage is that your workload needs to be optimized for this design, which isn't always possible, leave alone easy. They're great for graphic rendering, though. ;)
Anyhow, given the above, you can see that some would argue that going superscalar would defeat the whole point of a GPU living alongside a CPU in the same box...
There definitely is one - its cost is what those rightwing types are continuously whining about. You simply fell through one if its many holes. That's why it might need to be propped up a bit.
I have lived for several years in both the US and in one of those scary Social Democracies in Northwestern Europe. On both occasions, it was in cities with relatively large numbers of impoverished people (to local standards) and relatively high crime rates (also to local standards). The "to local standards" is important, because the differences were stark. It even affects the quality of life of middle-class people living in the same place.
Now, what are your experiences, apart form having read Breitbart, watched Fox News, and perhaps gone on vacation abroad a few times? If the answer is "none", who's being close-minded here?
I came here to say exactly this. Intel/ATI is exactly what I don't want; gimme AMD/Nvidia and I'm in heaven.
Yes, from a purely short-sighted insulary money-centered point of view, it is a bit of a paradox. To make it even more tragicomical, the paradox exists on both sides: there's a large population that vehemently votes against anything that would strengthen social safety net, even though they are the ones who would benefit from it most.
I believe the paradoxical state of things was exactly the point GP was trying to make. To put it crudely: those who are mature enough to rise above the short-sighted POV are doomed to support those who keep on trying to shoot themselves in the feet.
Variant 2 is being patched in compilers. Both gcc and clang are working on patches (that might already be released?) that avoid any speculative execution of indirect branching. Using a trick documented by google to patch the stack with the destination address, and then return. So now we just have to recompile *everything* that has access to privileged / sensitive memory contents to hopefully prevent attackers doing anything useful with branch poisoning. Of course there will be a performance hit, as no indirect branches can be correctly predicted.
Interesting! Thank you for the additional info.
Thanks a lot for the reviewing and corrections! I hope not only I but the /. community at large will get some benefit out of this exercise.
I guess I did get a bit lazy with verifying statements about ARM. Also, I'm surprised on a somewhat more fundamental level that it's so badly affected, so some confirmation bias might have been at play. If a lot of the same issues turn up in a completely different architecture, then Intel's "hard-to-foresee consequences of logical design decisions" attitude might have some merit after all.
Though that doesn't excuse their "conflation smoke screen". They deserve the class action lawsuit for that alone.
He's also dead right in that Intel has been mixing up the two issues, Meltdown and Spectre, deliberately, so they could tell everyone that it wasn't just Intel that was affected, and they also gave the impression that Spectre had been fixed when it was Meltdown that had been mitigated - with a patch that creates unacceptable performance problems, to a lesser or a greater extent.
This, in spades. While Theo De Raadt is not my favorite IT personality, the mixing together of the issues (actually 3 of them!) has made it exceedingly hard for someone who isn't familiar with the inner working of modern CPU architectures to get the story straight, and Mr. De Raadt gets kudos for calling them out on it.
The following is what I could infer from what I found online. I'm almost certain a good portion of it is WRONG, and I hope the more knowledgeable part of the /. crowd will help me out by correcting it. (No, I'm not being lazy - just stretched to the limit of my understanding of the primary sources, yet desperate to gain some working understanding beyond the "it's hard to explain but you should apply patches" advice found everywhere on the internet.)
You wait till AI gets more mature... and we find the AI equivalent of "attractive specimen of the opposite gender".
Errm... there exists such thing as creativity in STEM fields too. Your "working as a barista in Los Angeles" argument doesn't really apply to the premise of TFA. Also, it's not about "writer's block", but about the fact that frantically churning away at some deadline takes away all breathing room needed to come up with / try out some out-of-the box solution that may turn out to be vastly more opportune in the long run. RTFA, sheesh.
Thank you for thoroughly showcasing the misinformation I was talking about. I rest my case.
Unfortunately no time for debunking all the tired old talking point. Some basic (reasonably unbiased) reading on the subject should do the trick, though.
That would only be true in American speak, where decades of anti-socialist brainwashing have successfully led to an almost-universal conflation of "socialist" and "communist". In most of the rest of the world, "socialism" (or more precisely "social democracy", though that doesn't roll off the tongue as well) is pretty much synonym to "strong welfare", and something different from "communism", which would refer to one particular, notoriously misguided attempt at implementing socialism.
<Insert most common counterargument>
Yes, the Soviet Union called itself "Socialist". North Korea also calls itself Democratic... Neither gets the monopoly on That Word.
Tiny nitpick: if you're using "ssh -CX", you're also having the compression benefit. For a lot of applications, it actually speeds up X11 forwarding quite a bit (possibly because of what you just said; bitmaps images of desktop applications are often very compressible).
I find buying used (nontrivial) electronics (and using other people's electronics) icky. It's the cybersecurity equivalent of donning a piece of underwear that was found at the roadside. One could argue "nothing a good round of disinfection won't fix", but that gets a lot more complicated than "wash hot".
The electrical fire's intensity damaged two substations serving the airport, including the airport's "redundant system" that should have provided backup power, Reed said.
Am I the only one who finds it strange that two supposedly redundant systems are housed under the same roof, or at least so close together that both of them can be damaged by the same fire? At my last employer, we duplicated stuff that is far less critical over 2 buildings located at a good distance from each other...
Except that to create the illusion of a round earth, light rays would need to curve upward over distance.
As has slashdot.
Sure, but this is a relatively large-scale crowdsourced operation. It takes a peculiarly twisted individual to spew that much BS all by himself. It's so bad that it has become a newsworthy rarity for a significant truth to come out of that corner.
Think of it, most people willfully avoid being caught spewing patently wrong information in public for reasons such as dignity, self-esteem, standing with others,...
I guess you flunked out of high school biology class. Zygote, embryo, and fetus are legitimate scientific terms.
I wonder if whoosh is also a scientific term.
Yeah, it's for humor (often sarcasm) that went over someone's head :) What we have here is more a complete (deliberate or otherwise) failure to read the first 5 words of the post one is replying to.
Topic. Cellphone radiation. Not Mashiki's character.
And yet you're talking about the one, not the other, of your own free will and deliberate purpose.
Congratulations, you trolled me into feeding you. Since you're so nice as to draw my attention to it, I will cease doing so effective immediately.
Yes, he is toxic, vile, and despicable
Be that as it may, this is a discussion about a predefined topic, and he might have something interesting to say about it. Closing your ears and singing an unrelated song makes you "one of them".
The man with brain cancer was you, right? Because your offtopic post is not making any sense in the current context.
What? I despise irrelevant ad hominem attacks regardless of whether they are aimed at my friends or my enemies. Double if they originate from an AC.
I can't find much actual scientific information in any of the links in the summary. Can someone please provide a link to the actual findings of which mention is made? (Yeah, I'm too lazy to do it myself.) Or has the word "findings" taken on an "alternative" meaning?