RERebelgecko·Jan 4, 2018
Maybe it's just because this is a more technical update, but the responses from Intel[1] and AMD really seem like night and day to me. This page is for the most part clearly written and only has a minimal amount of BS before getting to the point about:
• identifying the problems (without casting aspersions on other vendors or being FUD-y about issues that don't exist)
• specifying what _specific_ hardware is vulnerable
• info for developers (here's the patches you need if you're building your own kernel, here's a new compiler intrinsic that will be available soon for your applications, here [2] is code to implement the intrinsic yourself if you're not able to update your compiler)
• slightly less useful info for end users (update your stuff, which isn't necessarily actionable advice for some of us on Android)
• lets us know that future ha
Read the rest
rdware may still require the KPTI patches, but it sounds like the speculative execution issues that aren't fixed by the patches ("variant 1") will be fixed in hardware
Things that still aren't great:
• no mention of performance impact of their various mitigation strategies that surely someone would have benchmarked in the 6 months they've been working on this. However I'm sure before too much longer someone will grab that code from their github and compare it to regular memory accesses
• this FAQ purporting to be in layman's terms definitely isn't [3]. Imagine telling your elderly relative that saw an article about scary computer bugs in the New York Times that the problem is just a "novel use of an existing side-channel technique" to "access data from privileged memory (DRAM or CPU cache)."
[1] https://newsroom.intel.com/news/intel-responds-to-security-r...
[2] https://github.com/ARM-software/speculation-barrier/blob/mas...
[3] https://developer.arm.com/support/security-update/frequently...