First the Apple battery slowdown scandal, now this from Intel.
This actually sounds like a pretty big deal since it is so widespread and involves the CPU core "protected memory".
"The processor security flaw that has the tech world abuzz is already being fixed for Windows computers — but the fix doesn't completely solve the problem, and right now it's only available for those running the latest version of the operating system.
The security flaw affects Intel, AMD, and ARM processors. It's been widely reported that fixing it could require most PCs to take a sizable performance hit. "
An intelligent man believes only half of what he hears, a wise man knows which half. -EVAN ESAR
If you are running Win 7 and have an AMD processor (which is less affected by the flaw above) you may want to wait on the MSFT updates. Blue screens on reboots are being reported for AMD machines. (Check computer, system properties).
Hopefully you have automatic updates restricted, MSFT pulls back Jan. updates for AMD machines. I saw mine show up yesterday, and then it disappeared this AM.
Intel machines tend to be more high performance for the workplace, AMD are more the consumers low end stuff, mostly ok for home use and internet surfing.
This article goes into more techie detail about these two bugs, meltdown and spectre.
My view is to always wait a few weeks on these updates from MSFT, they tend to use home users as guinea pigs to test their monthly updates. Harder to do with Win 10 which updates automatically. Although you can set your wifi to "metered" which supposedly slows down windows 10 updates.
The real fixes will come later anyway, with BIOS firmware updates from Intel AMD etc. via your hardware mfr.
An intelligent man believes only half of what he hears, a wise man knows which half. -EVAN ESAR
You're going to need a vendor-provided BIOS firmware providing a CPU microcode update, one that most likely does not (yet?) exist unless your CPU was released in the last few years. Alternately, you need a retpoline-recompiled OS kernel in order to mitigate Spectre variant II branch-injection exploits. Unfortunately, this patch is resulting in systems performing as much as 30% slower than they're supposed to under certain kinds of computing workloads (generally ones that were already quite demanding of resources to begin with). Then, in addition to this, there's Meltdown (variant III) if you have an Intel CPU. This has been mitigated in the Linux kernel and via available Windows7 or newer updates. It does appear as though the problem first appeared in the Pentium Pro architecture (1995), around half a year after:
On May 8, 1995, a paper called "The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems" published at the 1995 IEEE Symposium on Security and Privacy warned against a covert timing channel in the CPU cache and translation lookaside buffer (TLB). This analysis was performed under the auspices of the National Security Agency's Trusted Products Evaluation Program (TPEP).
and also around the time of the Clipper Chip controvery, where we established forever that eavesdropping electronically without a warrant is in fact illiberal, illegal, anti-Democratic, it's an Un-American invasion of privacy and it's an endlessly-deplorable undermining of our sacrosanct civil liberties.
Once the vulnerability was generally known, it took coders less than a week to start demonstrating the hardware exploit with software. We're still early, but approaching a point where we can expect some serious attacks can potentially be carried out against unpatched systems already.
Good point about the Bios firmware updates. I have to wonder if older models are even going to get updates? There are tons of versions of CPUs and processor boards and memory variations out there over the last couple decades. It would seem to me like a monumental task to write and thoroughly test firmware code for all the cpus. I see some class action law suits coming.
An intelligent man believes only half of what he hears, a wise man knows which half. -EVAN ESAR
If you're wondering which vulnerabilities you may be exposed to, you can run this Windows-based utility to test your system: https://www.grc.com/inspectre.htm
Most people, even with all the OS updates available, are still going to be vulnerable to Spectre. This isn't academic, either, as it's been established Spectre exploits can be run in JavaScript right there in your web browser. (Firefox has already mitigated this in a recent update, and I believe Google has also now released Chrome 64 browser, which also has a browser-based mitigation against JavaScript Spectre exploits. (read more here: http://www.zdnet.com/article/google-chr ... tre-fixes/)
