Posts by owlstead 19 publicly visible posts • joined 28 Sep 2011
Nice comment, but zip usually uses password based key derivation and symmetric encryption; it is already quantum safe (assuming that the password is sufficiently safe of course, but that's an issue that's plaguing password based encryption *right now*). So yeah, agree but for the last sentence; zip is not a good example.
Heartbleed directly leaked all information within OpenSSL including private keys through a ping reply. That's a different order than machine level instruction execution and much easier to exploit, especially from a distance. Basically anybody in control of the network routing could steal your private key and act as a bonafide server, requiring a new key ceremony and certificate. Furthermore, it would be very hard to determine if the private key was leaked in the first place.
For system admins basically the sky *was* falling, and - serious as this is - this is not on the same scale. Currently you are the only one that tries to sensationalize the news.
I'd guess that the problem is getting the computer to run the exploit code. On shared servers I would definitely not say that this is "medium risk" though. In general: running native code should not allow you to grab information from other processes (obviously). Personally I'd go for "high risk" even if it is hard to exploit e.g. using a web page.
The problem is that you really don't want to switch to HDD or SSD, because that will never go right. The only reason why you would still want to swap is that some memory is actually not used by applications. Basically: if you really run out of memory that is required for calculations then everything grinds to a halt: you either get disk trashing or you simply get an error. Compare that with a lack of CPU power: everything goes slower, but that scales more or less linearly (more or less since current processors do not allow you to boost indefinitely with normal cooling). So yes, you do want to make sure everything fits into memory and leave some spare memory for disk caching and the like.
Yes, I know address lines are binary. The problem is that my brain isn't. It's that network speeds and hard disk drives are now all using 1 GB is 1000 x 1000 x 1000. Let's quit this nonsense now and let everybody have more memory.
Here's a handy little table:
1 GiB = 1.07 GB
2 GiB = 2.15 GB
4 GiB = 4.29 GB
8 GiB = 8.59 GB
12 GiB = 12.88 GB
16 GiB = 17.18 GB
24 GiB = 25.77 GB
32 GiB = 34.36 GB
48 GiB = 51.54 GB
64 GiB = 68.72 GB
96 GiB = 103.08 GB
Everybody except the memory producers are using the correct system now, let them be next. This is the best time for it. Or at least let them use 1 GiB. Because I'm getting tired of having to explain if 1 GB of data is using 1 GB if it is in memory and more than that on my drive.
At the time it was introduced hyperthreading only offered a mere 10% or so of performance improvement and even slowed down the CPU for others.
Here is a comment that discusses it at technical detail for the Intel P4.
https://www.reddit.com/r/Amd/comments/7tzum9/does_zen_architecture_receive_single_thread/dthd122
That's a long way off for what you can do with SMT on current processors, especially when it comes to CPU and thread heavy workloads:
https://www.hardwarecanucks.com/forum/hardware-canucks-reviews/74880-amd-ryzen-7-1700x-review-testing-smt-4.html
So yeah, switching off SMT (Hyperthreading is an Intel marketing term) is generally a very bad idea with regards of performance. Rendering video is a common use case for faster CPU's - if you don't want that buy a cheaper CPU without SMT.
If I was on a multi-core chip I would want to enable it (preferably automatically) only for certain applications. But I don't think we have options for that.
You cannot trust your Raspberry Pi fully either. In the end you should ask yourself what there is to be gained by the seller, and at what effort, and to what price. If it is white-label, they won't be hurt by bad press. But the larger manufacturers and distributors have a lot to lose. Sometimes the free market does provide some protection.
In the end you should not act paranoid either. But, to be honest, with computers it is hard to tell where you should draw the proverbial line.
They did implement a fuse, from the Intel response:
This includes setting "End of Manufacturing."
that's a software fuse. Obviously you should not be able to access manufacturing mode after this state change has been performed, software tool or no software tool.
Meh, I'd just given him an UltraSilencer (Electrolux vacuum cleaner). I can play my music at normal noise levels with that thing on. The only problem is explaining to others using it is that YES it is on and - no - you don't want to use the max setting on carpet (cause it sucks itself to the floor if you do that).
They are one of the first, after Google and Sun (now Oracle), who had prototypes as of 2005/2006. Oracle still seems to deliver these - or at least in 2010, but only on request (I can imagine it is a bit expensive to keep stock for such a thing). In other words, they are slightly late to the party.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
