Planet Rugby Forum

Big bank and other financial databases could be very vulnerable, as running 30% slower will eventually lead to a lock up, and no money coming out of ATMs. And adding server capacity takes time and money.

As said in the Nama thread , the share price has dropped 1% it's a nothing story. If this was significant the share price would have taken an absolute hammering

camroc1 wrote:Big bank and other financial databases could be very vulnerable, as running 30% slower will eventually lead to a lock up, and no money coming out of ATMs. And adding server capacity takes time and money.

No money coming out of ATM, scaremonger much?

No idea what the flaw is, but I do not appear to have been affected over the years.
I see no reason now to do an update to make my laptop slower than it already is.

Does this mean my PC will no longer run Crysis?

Perfect timing as Blue-Sky Thinkers push all their Business' Compute into AWS and AZURE stacks that are all running Intel Procs!


MacPhiles should also be concerned!

https://www.google.co.uk/amp/s/amp.busi ... law-2018-1

Intel was aware of the chip vulnerability when its CEO sold off $24 million in company stock

Intel CEO Brian Krzanich sold off $24 million worth of stock and options in the company in late November.
The stock sale came after Intel was informed by Google of a significant vulnerability in its chips - a flaw that only became public this week.
Intel says the stock sale was unrelated to the vulnerability, but came as part of a planned divestiture program. But Krzanich put that stock sale plan in place in October - several months after Intel was informed of the vulnerability.

Oh dear. Though, no doubt he will get out of this one.

camroc1 wrote:as running 30% slower will eventually lead to a lock up

This doesn't seem to be a concern for all the financial institutions that are buying into the blockchain bubble.

Doesn't seem to effect everything, but apparently servers are most likely to be heavily effected. Basically they decided to skip security checks for 10 years, and got away with it, now they have to take it into account, unsurprisingly things slow down.

Leinster in London wrote:No idea what the flaw is, but I do not appear to have been affected over the years.
I see no reason now to do an update to make my laptop slower than it already is.

The vulnerability is that any malicious software on your system can read all of the system's memory. In theory a process is isolated so it can only read the memory it has allocated. This vulnerability means a hacker could get your internet banking password by reading your browser's memory or similar. It's a really huge deal, as it doesn't need to trick you into giving the process any special privileges or anything.

It's not only Intel, either. There is an Intel specific vulnerability (Meltdown) that can be fixed by updating your operating system (though with the performance costs), but they've also announced another called Spectre that essentially affects all modern processors, and I think requires specific fixes per application - can't be fixed at the OS level. Fortunately it's harder to exploit, but it's a huge deal.

Better explanation here:
https://meltdownattack.com/

Seems like a pretty big fudge up. The repetitional damage could could them more in the long run than the cost to fix this, which will surely be in the billions.

Bit unfair that it's Intel copping all the reputational damage when Spectre affects all modern processors.

Mahoney wrote:Bit unfair that it's Intel copping all the reputational damage when Spectre affects all modern processors.

Intel's is far more serious though I believe? And from what I can tell, it's basically because they skipped out on security checks that AMD has in place. For 10 years they've profited from having less security in place, I doubt they're too upset considering how well they've gone in that time.

Mahoney wrote:Bit unfair that it's Intel copping all the reputational damage when Spectre affects all modern processors.

That will happen when you dominate the market.

Just like Apple cops the flack for worker conditions in Chinese factories when the same factories also make every other phone under the sun. Intel is a big name and will have to take this on the chin.

The Intel specific one is both easier to exploit and easier to mitigate; whilst the drop in performance is obviously highly undesirable, at least you can update your operating system and job done, you're safe again. No such simple one shot fix for Spectre, unfortunately; all individual programs you run need to be updated to guard against it. Or buy a new processor once they've fixed it in hardware.

Mahoney wrote:The Intel specific one is both easier to exploit and easier to mitigate; whilst the drop in performance is obviously highly undesirable, at least you can update your operating system and job done, you're safe again. No such simple one shot fix for Spectre, unfortunately; all individual programs you run need to be updated to guard against it. Or buy a new processor once they've fixed it in hardware.

So to have a go at all chipmakers for Spectre would seem a little unreasonable no? Intel's one is seemingly specifically because they made a choice not to have the same security checks that companies such as AMD put in (and thus have lower performance).

For 10 years Intel has had a great market share due to superior processors, which are now potentially only superior due to not being as secure as other options, and the software fix has the potentially to ridiculously reduce the processing power (some tests in some software show greater than 30% reductions). A worldwide issue, such as Spectre, is far more easily forgiven, than a company specific one.

camroc1 wrote:Big bank and other financial databases could be very vulnerable, as running 30% slower will eventually lead to a lock up, and no money coming out of ATMs. And adding server capacity takes time and money.

Adding server capacity is a tiny issue, if they haven't got scalability built into their models then they are way behind the times. With the amount of data they are warehousing you can be sure they are on top of it.

Raggs wrote:

Mahoney wrote:The Intel specific one is both easier to exploit and easier to mitigate; whilst the drop in performance is obviously highly undesirable, at least you can update your operating system and job done, you're safe again. No such simple one shot fix for Spectre, unfortunately; all individual programs you run need to be updated to guard against it. Or buy a new processor once they've fixed it in hardware.

So to have a go at all chipmakers for Spectre would seem a little unreasonable no? Intel's one is seemingly specifically because they made a choice not to have the same security checks that companies such as AMD put in (and thus have lower performance).

For 10 years Intel has had a great market share due to superior processors, which are now potentially only superior due to not being as secure as other options, and the software fix has the potentially to ridiculously reduce the processing power (some tests in some software show greater than 30% reductions). A worldwide issue, such as Spectre, is far more easily forgiven, than a company specific one.

Yes, exactly this. Intel's market dominance is based on superior performance which is now wiped out by having to account for this flaw.

It's huge.

The Volkswagen of computing ...

Yourmother wrote:https://www.google.co.uk/amp/s/amp.busi ... law-2018-1

Intel was aware of the chip vulnerability when its CEO sold off $24 million in company stock

Intel CEO Brian Krzanich sold off $24 million worth of stock and options in the company in late November.
The stock sale came after Intel was informed by Google of a significant vulnerability in its chips - a flaw that only became public this week.
Intel says the stock sale was unrelated to the vulnerability, but came as part of a planned divestiture program. But Krzanich put that stock sale plan in place in October - several months after Intel was informed of the vulnerability.

Oh dear. Though, no doubt he will get out of this one.

The scary thing is how brazen some of these so-called smart people are.

Anyone know what the first Intel CPUs which fix Meltdown & Spectre are, or will be? Any word from AMD as to CPUs that don't suffer from Spectre?

I've been planning on getting a new PC, and it would seem sensible now to wait for hardware that does not suffer from either; or are we talking multiple years?

Mahoney wrote:Anyone know what the first Intel CPUs which fix Meltdown & Spectre are, or will be? Any word from AMD as to CPUs that don't suffer from Spectre?

I've been planning on getting a new PC, and it would seem sensible now to wait for hardware that does not suffer from either; or are we talking multiple years?

Meltdown - you'll need an 8-series, as I understand it.

Mahoney wrote:Anyone know what the first Intel CPUs which fix Meltdown & Spectre are, or will be? Any word from AMD as to CPUs that don't suffer from Spectre?

I've been planning on getting a new PC, and it would seem sensible now to wait for hardware that does not suffer from either; or are we talking multiple years?

On the Intel front, I suspect that a genuine design fix is a year or two away at least; it will require an architecture change.

For AMD and Spectre, it's actually not currently clear that they really are at risk yet. They way they implement x86 is different to Intel

Uncle Fester wrote:

Yourmother wrote:https://www.google.co.uk/amp/s/amp.busi ... law-2018-1

Intel was aware of the chip vulnerability when its CEO sold off $24 million in company stock

Intel CEO Brian Krzanich sold off $24 million worth of stock and options in the company in late November.
The stock sale came after Intel was informed by Google of a significant vulnerability in its chips - a flaw that only became public this week.
Intel says the stock sale was unrelated to the vulnerability, but came as part of a planned divestiture program. But Krzanich put that stock sale plan in place in October - several months after Intel was informed of the vulnerability.

Oh dear. Though, no doubt he will get out of this one.

The scary thing is how brazen some of these so-called smart people are.

What's scary is you'd let someone stupid enough to hold the stock in full knowledge it was going to tank running the company

JM2K6 wrote:

Mahoney wrote:Anyone know what the first Intel CPUs which fix Meltdown & Spectre are, or will be? Any word from AMD as to CPUs that don't suffer from Spectre?

I've been planning on getting a new PC, and it would seem sensible now to wait for hardware that does not suffer from either; or are we talking multiple years?

Meltdown - you'll need an 8-series, as I understand it.

Wouldn't think 8-series would be safe either.

this thread needs more leinsterman, he worked for Intel for years, and added the bug where if you type 'iloveleinster' your pc's speed increased 10%

Traveller wrote:

camroc1 wrote:as running 30% slower will eventually lead to a lock up

This doesn't seem to be a concern for all the financial institutions that are buying into the blockchain bubble.

I'm not aware of any crypto-currencies that are mined on CPUs. Almost all are mined on ASICs or NVidia/AMD GPUs. (I'm sure there are some, but none of the major ones use CPU mining).

Raggs wrote:

JM2K6 wrote:

Mahoney wrote:Anyone know what the first Intel CPUs which fix Meltdown & Spectre are, or will be? Any word from AMD as to CPUs that don't suffer from Spectre?

I've been planning on getting a new PC, and it would seem sensible now to wait for hardware that does not suffer from either; or are we talking multiple years?

Meltdown - you'll need an 8-series, as I understand it.

Wouldn't think 8-series would be safe either.

I read yesterday that the Coffee Lake CPUs weren't affected, but it's entirely possible the bigger scope of the announcement has meant that's simply not true

JM2K6 wrote:

Raggs wrote:

JM2K6 wrote:

Mahoney wrote:Anyone know what the first Intel CPUs which fix Meltdown & Spectre are, or will be? Any word from AMD as to CPUs that don't suffer from Spectre?

I've been planning on getting a new PC, and it would seem sensible now to wait for hardware that does not suffer from either; or are we talking multiple years?

Meltdown - you'll need an 8-series, as I understand it.

Wouldn't think 8-series would be safe either.

I read yesterday that the Coffee Lake CPUs weren't affected, but it's entirely possible the bigger scope of the announcement has meant that's simply not true

Coffee Lake is definitely impacted by Meltdown. There was some earlier speculation that since Intel knew about Meltdown before they released Coffee Lake, they would have designed it out, but the designs and specs for Coffee Lake were fixed ages ago.


There is a genuine question about how much of an impact the software fix for Meltdown will actually impact you - if all you do is general use (gaming, email, a bit of Word processing etc) then you may not see any performance hit at all.

If you want a Spectre-proof chip though then you are likely to be waiting a long time - it's still not completely understood what the implactions of Spectre are, what manufacturesrs are affected etc. but on the flipside it's far less clear how to use this as an attack vector. A genuine Spectre-proof chip design could be a complete review of CPU architecture across the board

Ah, cheers. Yeah was just reading a shitload of facts and speculation mixed together yesterday.

Our lovely new big data clusters are going to be a bit unhappy with all this

Saint wrote:
Coffee Lake is definitely impacted by Meltdown. There was some earlier speculation that since Intel knew about Meltdown before they released Coffee Lake, they would have designed it out, but the designs and specs for Coffee Lake were fixed ages ago.


There is a genuine question about how much of an impact the software fix for Meltdown will actually impact you - if all you do is general use (gaming, email, a bit of Word processing etc) then you may not see any performance hit at all.

If you want a Spectre-proof chip though then you are likely to be waiting a long time - it's still not completely understood what the implactions of Spectre are, what manufacturesrs are affected etc. but on the flipside it's far less clear how to use this as an attack vector. A genuine Spectre-proof chip design could be a complete review of CPU architecture across the board

Yup, some people have taken the sentence could hit some tasks by 30% to mean all tasks will be hit by 30%. A classic over reaction

Fun twitter thread: https://twitter.com/wycats/status/948812652997885952

JM2K6 wrote:Fun twitter thread: https://twitter.com/wycats/status/948812652997885952

I understood about 15% of what they were talking about. And I've worked in IT for 20 years.

sewa wrote:

Saint wrote:
Coffee Lake is definitely impacted by Meltdown. There was some earlier speculation that since Intel knew about Meltdown before they released Coffee Lake, they would have designed it out, but the designs and specs for Coffee Lake were fixed ages ago.


There is a genuine question about how much of an impact the software fix for Meltdown will actually impact you - if all you do is general use (gaming, email, a bit of Word processing etc) then you may not see any performance hit at all.

If you want a Spectre-proof chip though then you are likely to be waiting a long time - it's still not completely understood what the implactions of Spectre are, what manufacturesrs are affected etc. but on the flipside it's far less clear how to use this as an attack vector. A genuine Spectre-proof chip design could be a complete review of CPU architecture across the board

Yup, some people have taken the sentence could hit some tasks by 30% to mean all tasks will be hit by 30%. A classic over reaction

Yeah, Coffeelake is exactly the same CPU core as Kaby Lake, which was exactly the same as Skylake. They were rushed products to fill in for the fact that Cannonlake was going to be very, very late, & everyone loved the tick/tock cadence; so they made some minor architectural changes & tweaked the production process, & then slapped a new name on the result.

I also worked at Intel for a very long time

I'd guess; if this problem was discovered last summer, any fix won't make Cannonlake either, so they'll either have the decision to dump a shit load of processors they've built, or skip it & try & pull in Icelake.

Next PC will be using AMD Ryzen so!

Web devs will understand it. Basically it's people noticing that the Chrome developers have basically claimed that one of the most fundamental ways in which we use the internet is now dreadfully insecure.

sewa wrote:

camroc1 wrote:Big bank and other financial databases could be very vulnerable, as running 30% slower will eventually lead to a lock up, and no money coming out of ATMs. And adding server capacity takes time and money.

Adding server capacity is a tiny issue, if they haven't got scalability built into their models then they are way behind the times. With the amount of data they are warehousing you can be sure they are on top of it.

Not in OZ.......

Pat the Ex Mat wrote:

sewa wrote:

camroc1 wrote:Big bank and other financial databases could be very vulnerable, as running 30% slower will eventually lead to a lock up, and no money coming out of ATMs. And adding server capacity takes time and money.

Adding server capacity is a tiny issue, if they haven't got scalability built into their models then they are way behind the times. With the amount of data they are warehousing you can be sure they are on top of it.

Not in OZ.......

Seriously? The world is full of companies that can design / build this stuff for you. If big banks are leaving themselves vulnerable in terms of server capacity then they must be fierce bloody thick.

YOYO wrote:

Sandstorm wrote:

JM2K6 wrote:Fun twitter thread: https://twitter.com/wycats/status/948812652997885952

I understood about 15% of what they were talking about. And I've worked in IT for 20 years.

Probably a bit like saying i’m a car sales man yet I haven’t a clue what those formula 1 engineers are taking about. How would you be expected to know?! Not unless your a Google engineer or similar.

My roles over the years have been a bit more technical than "PC salesman"

There's bound to be many more undiscovered vulnerabilities in systems so complex as a microprocessor. Interesting stuff though. Speculative execution? That's crazy shit. It's amazing how complex these machines are. Apparently the slow-down with the software fix in most cases will be more like 1%-2%, but can go up to 30% with programs doing unusual things (i.e. a lot of context switching and syscalls). Allegedly there will be not real discernable difference for most desktop PCs, but there probably will be for virtualization and servers.

FWIW, the Spectre vulnerability does also effect AMD chips.

I suspect for most of us, it'll be fine is we just follow the normal rules for keeping secure: keep your software up to date, change your passwords often, don't use the same password for everything, don't download and run weird shit, don't visit dodgy websites and click around randomly.