Well this is terrible news. It basically gives much more credence to those who advocated that SMT should be completely disabled for anyone running a security-critical system utilising shared...
Well this is terrible news. It basically gives much more credence to those who advocated that SMT should be completely disabled for anyone running a security-critical system utilising shared resources following the Spectre & Meltdown CVEs. The only positive is that ZombieLoad appears to be x86 implementation dependent and affects only Intel processors.
I can only imagine how increasingly keen companies are to escape Intel's lock. Apple will be one of the first to go alone with their own ARM processors on desktop. I wouldn't be surprised if others follow after this.
Given that AMD has seemed to avoid most of these vulnerabilities, wouldn't the path of least resistance be just switching to them as a supplier, at least in the shorter term?
Given that AMD has seemed to avoid most of these vulnerabilities, wouldn't the path of least resistance be just switching to them as a supplier, at least in the shorter term?
Apple going full ARM would instantly make their laptops and desktops completely unappealing to me. I've been really hoping they would bring back the modular cheese grater mac but if my development...
Apple going full ARM would instantly make their laptops and desktops completely unappealing to me. I've been really hoping they would bring back the modular cheese grater mac but if my development machine can't do double duty as a gaming machine then it's a non-starter for me.
I mean, with Marzipan beta 2 about to be released, it's basically a complete guarantee. The only remaining question is when; and I don't think that's far away either. Probably less than 18 months....
I mean, with Marzipan beta 2 about to be released, it's basically a complete guarantee. The only remaining question is when; and I don't think that's far away either. Probably less than 18 months. So I'd advise if this really is a dealbreaker for you, to start planning your alternative now.
Oh I'm already on alternatives. Windows and Linux are both totally viable as long as you don't do iOS development. I was on the fence about buying a Macbook Pro in 2016, then they released the...
Oh I'm already on alternatives. Windows and Linux are both totally viable as long as you don't do iOS development. I was on the fence about buying a Macbook Pro in 2016, then they released the awful new model with soldered on RAM.
If Apple released a proper modular workstation today like the old cheese grater Macs, I would buy one in a heartbeat, but Apple keeps moving further and further away from what I actually want in a computer. Their impending switch to ARM is the nail in the coffin that makes it much less likely for them to ever put out a new computer I'll find desirable.
This is a very large, complicated disclosure with a whole bunch of websites and information. This blog post about the ZombieLoad attack seems particularly interesting: ZombieLoad: Cross...
This is a very large, complicated disclosure with a whole bunch of websites and information. This blog post about the ZombieLoad attack seems particularly interesting: ZombieLoad: Cross Privilege-Boundary Data Leakage
In retrospect, Microsoft's decision to use ARM for its Surface series or computers looks very smart. I hope we'll see ARM powered workstation-type notebooks very soon. Until then, AMD seems to be...
In retrospect, Microsoft's decision to use ARM for its Surface series or computers looks very smart. I hope we'll see ARM powered workstation-type notebooks very soon. Until then, AMD seems to be the only choice.
This puts Intel at a huge disadvantage in the cloud server market too. With AMD unaffected, disabling Hyperthreading on Intel CPUs—as per the security recommendations presented here—represents a...
This puts Intel at a huge disadvantage in the cloud server market too. With AMD unaffected, disabling Hyperthreading on Intel CPUs—as per the security recommendations presented here—represents a non-trivial drop in performance while also increasing power consumption; and $/Watt is one of the king metrics in the datacenter.
If an application is using properly documented system APIs, then there's really no problems to worry about. Microsoft, Apple, or the OS provider will provide the suitable bytecode for the...
If an application is using properly documented system APIs, then there's really no problems to worry about. Microsoft, Apple, or the OS provider will provide the suitable bytecode for the architecture the platform is running on. The issue is with the bigger software vendors who use SPIs which aren't publicly documented or rely on hacks that the OS provider didn't anticipate, which is, admittedly, a lot of people. Adobe, etc are the big abusers here.
The fact of the matter is x86 is dated, has an absurdly long list of errata, and operation for operation, ARM implementations tend to be more power efficient—which benefits hardware vendors like Apple & Microsoft because they can create thinner, longer lasting mobile devices. ARM switchover in the consumer space is a "when", not "if" scenario.
I'm somewhat glad that ARM hasn't caught on yet for desktop/laptop users. That still leaves the possibility of RISC V sneaking into the market. That would still be years from now, though.
I'm somewhat glad that ARM hasn't caught on yet for desktop/laptop users. That still leaves the possibility of RISC V sneaking into the market. That would still be years from now, though.
Your points only hold true for currently supported software. If Adobe makes correct use of the OS provided APIs, then compiling an ARM version of Photoshop is easy. But replaceable tools like...
Your points only hold true for currently supported software. If Adobe makes correct use of the OS provided APIs, then compiling an ARM version of Photoshop is easy. But replaceable tools like Photoshop aren't what I care about. Old versions of tools are mere curiosities at best rather than software I'm concerned about being able to continue using long-term.
However there are thousands of video games out there for which this doesn't hold true at all. That new Free-to-Play Unreal Tournament game isn't any more a replacement for Unreal Tournament 2004 than the 2014 Robocop movie is a replacement for the 1987 original. I doubt Epic or any other developer is going to go back and release ARM binaries for all their old games, and I doubt x86 emulation on ARM is going to get fast enough to be a drop-in replacement for a real x86 chip in current games.
As long as the two major things I do on my desktop are develop software and play video games, switching to ARM is just a non-starter unless someone can invent some magic sauce that makes my entire library of games run and play just as well as they do today.
Yeah, sorry to say you're not the target market for a lot of modern products in that case. Especially so with desktop-class games on macOS, but you know this already. The sands of time hold true;...
Yeah, sorry to say you're not the target market for a lot of modern products in that case. Especially so with desktop-class games on macOS, but you know this already. The sands of time hold true; and just like every other piece of old software, they will slowly become more and more difficult to run or even emulate.
Give it 10-15 years and you may not have a choice of running retail x86 anymore if you use a computer. Just like barely anyone runs a PowerPC Mac now.
Yeah I'm well aware Apple doesn't seem to want my business. I would have been OK dual booting Windows. I would happily pay the Apple Tax for a workstation that officially supports macOS so I can...
Yeah I'm well aware Apple doesn't seem to want my business. I would have been OK dual booting Windows. I would happily pay the Apple Tax for a workstation that officially supports macOS so I can dip my feet in iOS development.
I don't see that happening. I haven't seen a compelling reason to ditch x86 on desktops. None of the recent exploits discovered are inherent to the platform, as evidenced by AMD's immunity. On top...
Give it 10-15 years and you may not have a choice of running retail x86 anymore if you use a computer.
I don't see that happening. I haven't seen a compelling reason to ditch x86 on desktops. None of the recent exploits discovered are inherent to the platform, as evidenced by AMD's immunity. On top of that, the underlying CPU architecture no longer resembles x86 as you or I know it anyways. The x86 instruction set has effectively turned into a abstraction layer implemented in microcode, so the idea that the underlying hardware can't be improved to close the efficiency gap doesn't hold much weight.
It doesn't seem like too long ago people were making the same claims about PowerPC.
For anyone using Linux: you can cat the files in /sys/devices/system/cpu/vulnerabilities to check if your CPU is vulnerable. Also look for the bugs section in /proc/cpuinfo. And don't forget to...
For anyone using Linux: you can cat the files in /sys/devices/system/cpu/vulnerabilities to check if your CPU is vulnerable. Also look for the bugs section in /proc/cpuinfo. And don't forget to keep your microcode and kernel up-to-date.
Sorry for replying so late, I don't have a vulnerable computer right now. Mine returns "not affected", if they return "mitigation" and the name of the mitigation you are patched against those.
Sorry for replying so late, I don't have a vulnerable computer right now. Mine returns "not affected", if they return "mitigation" and the name of the mitigation you are patched against those.
Why are we only recently getting these news? Spectre & Meltdown are quite recent too. Is it that new tech is developed that helps finding these bugs, or is it Intel dropping the ball as of recent?
Why are we only recently getting these news? Spectre & Meltdown are quite recent too. Is it that new tech is developed that helps finding these bugs, or is it Intel dropping the ball as of recent?
Someone asked a similar question on one of the HN threads about this, and I think some of the answers there are interesting: https://news.ycombinator.com/item?id=19912080
Thanks! BTW this comment appeared in my notifications but just disappeared when I refreshed the page. I don't have automatic marking on, I mark things manually. I can't have marked it read because...
Thanks!
BTW this comment appeared in my notifications but just disappeared when I refreshed the page. I don't have automatic marking on, I mark things manually. I can't have marked it read because IIRC they disappear the moment you click "Mark read", don't they?
No, I did both after, finding the comment again in the thread. WRT the setting, I had it disabled the day it was announced (all the checkboxes on https://tildes.net/settings are unchecked for my...
Did you vote on it or reply to it before refreshing?
No, I did both after, finding the comment again in the thread.
WRT the setting, I had it disabled the day it was announced (all the checkboxes on https://tildes.net/settings are unchecked for my account), I prefer to keep things there until I mark them manually.
Oh, I know what happened. I wanted to test a change I deployed related to removing posts, and just quickly removed and un-removed the first comment from my own user page, which happened to be that...
Oh, I know what happened. I wanted to test a change I deployed related to removing posts, and just quickly removed and un-removed the first comment from my own user page, which happened to be that one at the time. Removing a comment deletes all the notifications.
Sorry for the confusion, I forgot it would have that effect.
Well this is terrible news. It basically gives much more credence to those who advocated that SMT should be completely disabled for anyone running a security-critical system utilising shared resources following the Spectre & Meltdown CVEs. The only positive is that ZombieLoad appears to be x86 implementation dependent and affects only Intel processors.
I can only imagine how increasingly keen companies are to escape Intel's lock. Apple will be one of the first to go alone with their own ARM processors on desktop. I wouldn't be surprised if others follow after this.
Given that AMD has seemed to avoid most of these vulnerabilities, wouldn't the path of least resistance be just switching to them as a supplier, at least in the shorter term?
Apple going full ARM would instantly make their laptops and desktops completely unappealing to me. I've been really hoping they would bring back the modular cheese grater mac but if my development machine can't do double duty as a gaming machine then it's a non-starter for me.
I mean, with Marzipan beta 2 about to be released, it's basically a complete guarantee. The only remaining question is when; and I don't think that's far away either. Probably less than 18 months. So I'd advise if this really is a dealbreaker for you, to start planning your alternative now.
Oh I'm already on alternatives. Windows and Linux are both totally viable as long as you don't do iOS development. I was on the fence about buying a Macbook Pro in 2016, then they released the awful new model with soldered on RAM.
If Apple released a proper modular workstation today like the old cheese grater Macs, I would buy one in a heartbeat, but Apple keeps moving further and further away from what I actually want in a computer. Their impending switch to ARM is the nail in the coffin that makes it much less likely for them to ever put out a new computer I'll find desirable.
This is a very large, complicated disclosure with a whole bunch of websites and information. This blog post about the ZombieLoad attack seems particularly interesting: ZombieLoad: Cross Privilege-Boundary Data Leakage
In retrospect, Microsoft's decision to use ARM for its Surface series or computers looks very smart. I hope we'll see ARM powered workstation-type notebooks very soon. Until then, AMD seems to be the only choice.
This puts Intel at a huge disadvantage in the cloud server market too. With AMD unaffected, disabling Hyperthreading on Intel CPUs—as per the security recommendations presented here—represents a non-trivial drop in performance while also increasing power consumption; and $/Watt is one of the king metrics in the datacenter.
I'm very glad I purchased an AMD processor for my new desktop last year. Competition is so important in this space.
Or you could just use AMD and not lose support for all that x86 software people tend to like.
If an application is using properly documented system APIs, then there's really no problems to worry about. Microsoft, Apple, or the OS provider will provide the suitable bytecode for the architecture the platform is running on. The issue is with the bigger software vendors who use SPIs which aren't publicly documented or rely on hacks that the OS provider didn't anticipate, which is, admittedly, a lot of people. Adobe, etc are the big abusers here.
The fact of the matter is x86 is dated, has an absurdly long list of errata, and operation for operation, ARM implementations tend to be more power efficient—which benefits hardware vendors like Apple & Microsoft because they can create thinner, longer lasting mobile devices. ARM switchover in the consumer space is a "when", not "if" scenario.
I'm somewhat glad that ARM hasn't caught on yet for desktop/laptop users. That still leaves the possibility of RISC V sneaking into the market. That would still be years from now, though.
Your points only hold true for currently supported software. If Adobe makes correct use of the OS provided APIs, then compiling an ARM version of Photoshop is easy. But replaceable tools like Photoshop aren't what I care about. Old versions of tools are mere curiosities at best rather than software I'm concerned about being able to continue using long-term.
However there are thousands of video games out there for which this doesn't hold true at all. That new Free-to-Play Unreal Tournament game isn't any more a replacement for Unreal Tournament 2004 than the 2014 Robocop movie is a replacement for the 1987 original. I doubt Epic or any other developer is going to go back and release ARM binaries for all their old games, and I doubt x86 emulation on ARM is going to get fast enough to be a drop-in replacement for a real x86 chip in current games.
As long as the two major things I do on my desktop are develop software and play video games, switching to ARM is just a non-starter unless someone can invent some magic sauce that makes my entire library of games run and play just as well as they do today.
Yeah, sorry to say you're not the target market for a lot of modern products in that case. Especially so with desktop-class games on macOS, but you know this already. The sands of time hold true; and just like every other piece of old software, they will slowly become more and more difficult to run or even emulate.
Give it 10-15 years and you may not have a choice of running retail x86 anymore if you use a computer. Just like barely anyone runs a PowerPC Mac now.
Yeah I'm well aware Apple doesn't seem to want my business. I would have been OK dual booting Windows. I would happily pay the Apple Tax for a workstation that officially supports macOS so I can dip my feet in iOS development.
I don't see that happening. I haven't seen a compelling reason to ditch x86 on desktops. None of the recent exploits discovered are inherent to the platform, as evidenced by AMD's immunity. On top of that, the underlying CPU architecture no longer resembles x86 as you or I know it anyways. The x86 instruction set has effectively turned into a abstraction layer implemented in microcode, so the idea that the underlying hardware can't be improved to close the efficiency gap doesn't hold much weight.
It doesn't seem like too long ago people were making the same claims about PowerPC.
For anyone using Linux: you can
catthe files in/sys/devices/system/cpu/vulnerabilitiesto check if your CPU is vulnerable. Also look for thebugssection in/proc/cpuinfo. And don't forget to keep your microcode and kernel up-to-date.Sorry for replying so late, I don't have a vulnerable computer right now. Mine returns "not affected", if they return "mitigation" and the name of the mitigation you are patched against those.
Why are we only recently getting these news? Spectre & Meltdown are quite recent too. Is it that new tech is developed that helps finding these bugs, or is it Intel dropping the ball as of recent?
Someone asked a similar question on one of the HN threads about this, and I think some of the answers there are interesting: https://news.ycombinator.com/item?id=19912080
Thanks!
BTW this comment appeared in my notifications but just disappeared when I refreshed the page. I don't have automatic marking on, I mark things manually. I can't have marked it read because IIRC they disappear the moment you click "Mark read", don't they?
Did you vote on it or reply to it before refreshing? That will mark it read by default on refresh, but you can disable it if you prefer: https://tildes.net/~tildes.official/c4t/notifications_are_now_automatically_marked_as_read_when_you_take_an_action_on_the_comment_voting
No, I did both after, finding the comment again in the thread.
WRT the setting, I had it disabled the day it was announced (all the checkboxes on https://tildes.net/settings are unchecked for my account), I prefer to keep things there until I mark them manually.
Oh, I know what happened. I wanted to test a change I deployed related to removing posts, and just quickly removed and un-removed the first comment from my own user page, which happened to be that one at the time. Removing a comment deletes all the notifications.
Sorry for the confusion, I forgot it would have that effect.
No problem, thanks for the explanation!