Stories
Slash Boxes
Comments

SoylentNews is people

Spectre is Here to Stay: An Analysis of Side-Channels and Speculative Execution

posted by martyb on Saturday February 16 2019, @02:08PM   Printer-friendly
from the so-that-means...-we-are-screwed dept.

takyon writes:

Google security researchers have come to the conclusion that speculative execution attacks are here to stay without drastic changes to modern CPU architectures, such as removing speculative execution entirely.

Spectre is here to stay: An analysis of side-channels and speculative execution

Related:

Patch for Intel Speculative Execution Vulnerability Could Reduce Performance by 5 to 35% [Update: 2]
Qualcomm Joins Others in Confirming its CPUs Suffer From Spectre, and Other Meltdown News
Congress Questions Chipmakers About Meltdown and Spectre
What Impact Has Meltdown/Spectre Had on YOUR Systems?
Intel Admits a Load of its CPUs Have Spectre V2 Flaw That Can't be Fixed
Intel FPU Speculation Vulnerability Confirmed
New Spectre Variant SpectreRSB Targets Return Stack Buffer
Intel Discloses a Speculative Execution Attack in Software Guard eXtensions (SGX)
Intel 'Gags' Linux Distros From Revealing Performance Hit From Spectre Patches
MIT Researchers Claim to Have a Solution for Some Speculative Execution Attacks
Spectre, Meltdown Researchers Unveil 7 More Speculative Execution Attacks
New Side-Channel Leak: Researchers Attack Operating System Page Caches

Original Submission

 
This discussion has been archived. No new comments can be posted.
Spectre is Here to Stay: An Analysis of Side-Channels and Speculative Execution | Log In/Create an Account | Top | 36 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by zocalo on Saturday February 16 2019, @07:48PM (3 children)

    by zocalo (302) on Saturday February 16 2019, @07:48PM (#802151)

    Unfortunately, the companies that buy new hardware based on new CPU designs will not have a great market for selling their used equipment. "We replaced this stuff because it is a security risk ... so, you wanna buy it?"

    That's somewhat illogical. You're essentially saying CPU vendors shouldn't try and fix the flaw because of those few users that re-sell hardware rather than re-purposing/scrapping it when its initial reason for purchase has been completed. That only works if they have a cartel, otherwise the one eyed man is king and whichever CPU vendor has the least exposure to the flaw is going to have an advantage in selling their hardware. Keeping in mind that sales will be even higher if they can scupper the used market as a security risk as well, do you think Intel, AMD, ARM, et al care more about making a profit from new hardware, or a second hard market they no direct benefit from?

    --
    UNIX? They're not even circumcised! Savages!
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 0) by Anonymous Coward on Saturday February 16 2019, @08:40PM (2 children)

    by Anonymous Coward on Saturday February 16 2019, @08:40PM (#802171)

    You're essentially saying CPU vendors shouldn't try and fix the flaw because of those few users that re-sell hardware rather than re-purposing/scrapping it when its initial reason for purchase has been completed.

    Not at all. I'm saying the enterprise and data center markets are going to have to buy the new, more secure hardware and will get stuck with the old hardware (rather than selling it down market, as they currently do). So the new CPUs, which will be very expensive because of the significant costs associated with redesigning a major feature, will hit the large purchasers even harder than normal hardware upgrades do.

    • (Score: 3, Insightful) by zocalo on Saturday February 16 2019, @10:16PM (1 child)

      by zocalo (302) on Saturday February 16 2019, @10:16PM (#802204)
      Yes, they will. Tough. That's still no reason why CPU vendors shouldn't try and fix this for good, in the CPU hardware, ASAP. If anything the enterprise/DC customers are the ones who are most exposed to Spectre, especially if they are in the VM hosting business, and therefore they (and any customers) have the most to lose, so it's a simple business decision for them. I can't imagine a clueful customer looking for a secure VPS for something like an online ordering system is going to opt for a hosting provider that doesn't offer the latest in Spectre mitigations over one that does not, can you?

      Yes, they'll have to buy new hardware at some point (as will anyone else who cares about Spectre) and selling downmarket is going to mean either lower prices and/or finding buyers that don't care about Spectre, e.g. private compute clouds on segregated networks, for instance. What they can do though is phase it in gradually; "Latest & Greatest Spectre-proof CPU VPS - $20/mo" vs "Older CPU with Microcode/OS Spectre mitigations VPS - $15/mo". After that, it's just supply and demand, same as with any other phased roll out of the latest hardware.
      --
      UNIX? They're not even circumcised! Savages!