Prepare for your computer to slow down with your next OS update

Muad'zin said:
I wonder, if Intel was notified about this flaw in june, does that mean that the processors its currently making and which are on sale, have been fixed?
Click to expand...

I seriously doubt it. Fixing this is going to be really, really difficult apparently. There isn't even a completely viable workaround that OS vendors can implement for 2 of the 3 vulnerabilities discovered as part of this effort. Those two vulnerabilities (named Spectre) are on all mainstream processors that do out of order execution - ARM, AMD, and Intel. These vulnerabilities have been around a really long time and were just unveiled. They were discovered by some folks on Google Project Zero. But it doesn't mean that there aren't more people that have discovered this - perhaps even earlier.

Chip manufacturers are no doubt having to take a step back and rethink how they approach their role in the stack with regards to security.

We did that a number of years ago and it's a really rude awakening. These days our approach to security starts with the fundamental assumption that the system you are targeting is compromised and that the attackers have all of your design docs and source code.
 
Last edited:
So pretend I know nothing about computers, what’s a guy supposed to do if he is planning to drop a couple thousand on a new computer in the next couple months? Mac is not an option due to native pc software I need to run for work so I’ll need to stick to a windows based pc
 
Linus Torvalds said that if it's patchable via software it's unpatchable via hacks. they need to fix the chips.
 
Tahoebrian5 said:
So pretend I know nothing about computers, what’s a guy supposed to do if he is planning to drop a couple thousand on a new computer in the next couple months? Mac is not an option due to native pc software I need to run for work so I’ll need to stick to a windows based pc
Click to expand...

Mac's are not immune to the problem anyhow - the issues are with the CPUs, not the OSs. At this point I'd say that if you need a new computer, just buy a computer. I've not seen any sort of timetable for releasing systems with this fixed.
 
dpeterson said:
Linus Torvalds said that if it's patchable via software it's unpatchable via hacks. they need to fix the chips.
Click to expand...

The Meltdown issue that all the OS vendors are issuing patches for is a real fix for the specific problem. The Spectre issues cannot be solved completely without fixing the chips.
 
"For typical desktop users, the risk is arguably less significant. While both Meltdown and Spectre can have value in expanding the scope of an existing flaw, neither one is sufficient on its own to, for example, break out of a Web browser."

From this article:
https://arstechnica.com/gadgets/201...odern-processor-has-unfixable-security-flaws/

Most users won't notice the performance hit because of light use when the patches roll out. For those in the know, this only affects applications that make a lot of system calls. If you're a gamer, you're spending more time with the GPU, so no problem there.

I suspect that programs like Logic X are affected. Not good, since my 2011 MacBook Pro already struggles with it.

Either way, this is a phenomenal example of poor design....that it went unnoticed for such a long time is also troubling. For me, my life runs off that computer...that someone might be poking around over my shoulder because of some flaw in one of the applications that I have scares the hell out of me. Will I look one day and find my bank account emptied, my credit cards maxed?

My solution for Intel is to buy one of the Identity Threat companies and provide free protection for 3 years for anyone using their chips.
 
electronpirate said:
"For typical desktop users, the risk is arguably less significant. While both Meltdown and Spectre can have value in expanding the scope of an existing flaw, neither one is sufficient on its own to, for example, break out of a Web browser."

From this article:
https://arstechnica.com/gadgets/201...odern-processor-has-unfixable-security-flaws/
Click to expand...

Meltdown is a big deal for typical desktop users. Exploits have been developed in most current browsers to read whatever memory they want. Not sure about Spectre at this point.
 
So our overnight measurements at work show a 10-12% slowdown with the RHEL6 and 7 patches on our I/O-heavy database machines. That's not great, but not as bad as it could have been. These are exceptionally I/O bound boxes.
 
hippietim said:
Mac's are not immune to the problem anyhow - the issues are with the CPUs, not the OSs. At this point I'd say that if you need a new computer, just buy a computer. I've not seen any sort of timetable for releasing systems with this fixed.
Click to expand...

Would it be advisable then to buy a computer with an AMD chip instead of Intel then? From what I gather while Specter affects both manufacturers, only Intel seems to be affected by Meltdown.
 
iaresee said:
So our overnight measurements at work show a 10-12% slowdown with the RHEL6 and 7 patches on our I/O-heavy database machines. That's not great, but not as bad as it could have been. These are exceptionally I/O bound boxes.
Click to expand...

In some ways I'm lucky here. At work we have an app that is bound to a particular kernel, so we don't have to do patching. Surrounded by some very serious firewalls, so for the most part, we're good. I'm never happy about NOT patching, but in this case it works in my favor.

But HippieTim is right. It's going to be a bloodbath out there for awhile.
 
Muad'zin said:
Would it be advisable then to buy a computer with an AMD chip instead of Intel then? From what I gather while Specter affects both manufacturers, only Intel seems to be affected by Meltdown.
Click to expand...

If I were buying today I’d look more seriously at an AMD.

There are already strategies being divised for mitigating specific Spectre attacks. Time will tell what ends up being the more solid option.

The whole compute industry is resting on Intel and ARM chips - that’s every Windows, Mac, Linux, Android, and iOS device. Way too much is at stake.

In the meantime, I would highly recommend that you stop saving critical passwords and financial information in your browser auto-fill. I don’t care if some hacker uncovers my Gear Page password, but my brokerage account is something I’d like to keep to myself. You can bet that the majority of attacks will be coming from nefarious sites and email scams still so it’s best not to have these things lying around in memory.
 
  • Like
Reactions: Rex
USMC_Trev said:
Maybe because it has nothing to do with insider trading?

Insider trading is the trading of a public company's stock or other securities (such as bonds or stock options) by individuals with access to nonpublic information about the company.
Click to expand...
Well Intel apparently knew of the vulnerability at the beginning of November, before Krzanich filed with the board to liquidate his holdings. Now, whether Krzanich was aware of it at the time he filed is the thing that needs to be looked at. I'm sure SEC will poke around a bit here. Knowledge of the vulnerability would absolutely be considered material, non-public information and open him up for an insider trading lawsuit. The oddity is that Krzanich sold everything he could; he liquidated all but the 250,000 shares he's contractually obligated to retain while he's CEO.

Worth noting: shareholders can pursue their own civil investigation separately from the SEC. Obviously, that can't land him in jail but it can lose him the job and cost him a lot of renumeration.
 
Realistically, chip replacement is just not feasible. There's just way too many devices affected, and a large portion of them are non-user serviceable. Good luck replacing the CPU on a tablet or smartphone.
 
You must log in or register to reply here.
Back
Top Bottom