Posts by Doctor Syntax

Woo-yay, Meltdown CPU fixes are here. Now, Spectre flaws will haunt tech industry for years

Re: Itanic, S/Z

"S/z because there are simply better things for a mainframe to do than speculatively execute code"

There's a post above, a couple of hours older then yours, pointing to a Red Hat note saying System Z is vulnerable.

"Switching off speculative execution (if it's possible) will kill CPU performance. Some of the reports say that current CPUs can execute several hundred instructions whilst waiting for a single memory access request to main memory. That's a lot of lost CPU performance if you switch off speculative execution."

That doesn't stop better architectures restricting speculative execution to what they're allowed to see. Nor does it stop software architectures from being designed to better security standards.

"what happens when people realize there's no point in buying anything from any of us anywhere in the near future...?"

That realisation will be followed by another: we have work to do Right Now and everything's running slower; quick, order more kit. There'll be celebrations in the sales depts right now, especially in AMD. Intel? Looking for the leftovers if AMD can't keep up with orders. It's a good time to be selling memory, motherboards and everything else as well.

"Personally, I'm going to stick to my old faithful Z80"

I liked the Z80's trick of having two sets of registers and an instruction to flip between them. Very quick context change, no need to save registers or the like. Combine that with flipping between caches and mix in some notion of security rings and it could stage a come-back.

Re: That defence does not stand to scrutiny

"My guess is that AMD is about to get a serious inventory issue with not being able to print enough of them."

Subcontract production to Intel?

Meltdown, Spectre: The password theft bugs at the heart of Intel CPUs

"Nothing posted on the BSD sites."

Since I posted that FreeBSD announced they're working on it but they didn't get the notification until December.

Re: Dont for get supporting hardware..

"don't forget your routers, raspberry's, and all that wonderful IoT stuff many are based on (Broadcom) ARM Architecture"

ARM's site lists the affected processors. AFAICS Pis aren't amongst those affected. As per a previous comment about stuff you control - the embedded processors shouldn't be exposed to random stuff off the net.

Re: Maybe we dodged a bullet?

"Lots of fundamental development process rethinking required in the semi-conductor world required."

Or go back to some old ideas.

Does anyone remember the Z80? Two sets of registers and an instruction to swap between them. It made for quick context swaps. There were no security advantages, of course, because back then there was no concept of security rings on an 8-bit processor.

The same thing could be adapted to the modern world. Two sets of registers and two sets of cache (OK, for any given number of transistors it would mean reduced cache sizes for each half). That would mean that an independent address space could be kept for the kernel with only a single instruction to swap the context with one set having security privileges. Extra Brownie points if the cache split can be tuned to suit workloads. There might even be scope for adding more sets for quick changes between running processes.

Nothing posted on the BSD sites. Do they keep their kernels in a separate address space anyway and take the hit by design? If so you'd at least expect them to be pointing it out.

Re: Some real world results

"YMMV"

Pretty much what Linus said. If you don't make many kernel calls (computationally intensive, in other words) you shouldn't see much. If you make a lot of kernel calls then you get hit. It's the userland/kernel/userland transitions that are slowed down.

Re: Hmm, If I was working at a secret agency

"play God/quantum"

You raise an interesting point. Try mitigating this on a quantum computer taking all branches simultaneously.

Re: Hmm, If I was working at a secret agency

"ARM is British"

Was.

Re: " don't run untrusted code"

More likely

Now if we had some decent people at the W3C we would see Javascript being phased out them being ignored

Re: " don't run untrusted code"

"Disabling Javascript totally rather breaks the interwebs these days."

Most of the time I'll simply ignore a site that won't work at all without Javascript. If I think I really need it I'll see if I can selectively enable enough domains to make it work or see if the Google cached version is sufficient. Some sites manage to use so much Javascript as to break on some browsers even when fully enabled; eBay, I'm looking at your recent inability to display images in Seamonkey.

Re: Colour me surprised ....

"fly to wherever your correspondent lives and go for a nice walk and a chat in the woods."

Remember, even trees have ears: https://www.theregister.co.uk/2015/10/02/win_a_6tb_western_digital_black_hard_drive_with_iel_regi/

Re: Colour me surprised ....

"Now will people believe me ?"

You mean we should believe each and every A/C because they're you. Even when you contradict yourself multiple times in the same thread?

Linux Mint 18.3: A breath of fresh air? Well, it's a step into the unGNOME

Re: I wuv MSFT

"Never tried Linux Mint but I know I wouldn't like it."

Those of us who use Linux normally also get dragged in to fix friends' and relatives' Windows problems. So, when it comes to Windows we know we don't like it. In my case I even spent the last few years of my working life developing for it. Glad to be shut of it.

"Another change is that the Synaptics touchpad driver has been replaced by libinput. Practically speaking, this should have no effect for most users"

One change: SWMBO's new laptop has the mouse buttons built into the touchpad. That leads to a tendency to leave a finger of one hand resting on a button whilst trying to steer the pointer with the other hand. Chaos. Once I sussed that the distros that didn't have that problem used libinput instead of synaptics I could just install it on the preferred distro.

So, yes, a practical change but a good one.

Amazon: Intel Meltdown patch will slow down your AWS EC2 server

Re: maybe it's time to re-consider server-side inefficiency

"And, are Django/JS even in the crosshairs of the heavy KPTI CPU losses?"

I think BB's point was that if you were losing performance from Meltdown mitigation you might be able to reclaim it elsewhere by optimising userland.

And we return to Munich's migration back to Windows – it's going to cost what now?! €100m!

Re: Its not just the cost either...

"EU law says they can't. What US law says isn't relevant."

US govt. version:

US law says they can. What EU law says isn't relevant. Where is it? Oh, there. Doesn't make any difference.

"Munich, the only place in the world, where you can make charges of taking brown envelopes disappear with brown envelopes."

Doesn't that happen in other places? E.g. although the term "fine" is often used in press releases SEC investigations seem to involve a "settlement" with no wrongdoing acknowledged.

" In truth, the software licences are never the big line items in a business process improvement project."

They can, however, be a recurring cost and a nasty shock after a software audit. And, of course, an ongoing management cost in terms of trying to keep track of them.

"Brown envelops for city officials or free holidays in Seattle ?"

Maybe they're just into bondage.

"For example, proprietary formats such as MS Office that you cannot read on other packages."

Where, at least in the past*, that included older versions of the same MS Office application.

*I wouldn't know if that still applies. I haven't needed to use it for years but still find the LibreOffice opens any MS documents I get.

Maplin Electronics CEO ups stakes for steak house

Re: It's a crying shame......

"The B&Q of electronics. Have an upvote."

No need to be rude about Maplin like that. B&Q have had customer service on the downhill run for years.

Re: It's a crying shame......

"I am an old-fart now"

Not if you can remember then from your childhood. My original electronics shop had the owners Baird receiver on display.

Azure VMs borked following Meltdown patch, er, meltdown

Re: Yay! Welcome to the Cloud

"Oh, and 'test' is a 4-letter word"

User testing proceeding according to schedule.

Open-source civil war: Olive branch offered in trademark spat... with live grenade attached

Re: The most disturbing thing...

"On one memorable occasion, a Mike" etc

Now you're just taking the Mick

Jocks in shock as Irn-Bru set to slash sugar and girder content

Re: How to be English in Three Easy Steps

"time to start on the Xmas single malt collection."

Why were you delaying?

Re: Lateral Thinking

"Can't the 'traditionalists' just add a teaspoon of sugar to it when they open it?"

That's what I thought. And then I saw the problem. They need to drink it to steady the hand enough to pick up the teaspoon.

US Homeland Security breach compromised personal info of 200,000+ staff

Seems to me to be more in the "oops, no foul intended"

Except then when it was taken out of the office it wouldn't be subject to the strict and rigorous protection against unauthorised access and copying it would have had in the office. Or something like that.

Cool disk drive actuator pillar, Seagate – how about two of them?

How about increasing the throughput by using smaller drives and more of them, throwing in a few spares at the same time? We could call it Redundant Array of Inexpensive Drives.

Re: So...

"Seagates's split actuator thing perform the same as two half-sized drives in striped raid-0?"

Yes, providing you don't mind both of them failing at the same time.

Wannabe W1 DOW-er faked car crash to track down reg plate's owner

"They have internal combustion engines in Bristol now?"

IIRC they used to have SOHC 2l engines back in the days when there were still side-valve engines in use.

Re: And what about the DVLA?

"the rigmarole of a check"

The "rigmarole" could include requiring the crime number as per the OP and making 1 in N checks with the police. It's called "having a process in place".

It raises the question of how DVLA will respond to further requests from this guy's office in future. If they really do make the thorough checks which now seem appropriate it could cost him a packet.

We translated Intel's crap attempt to spin its way out of CPU security bug PR nightmare

Re: What's Not Mentioned .....

"$30 billion charge on VW for their dieselgate affair"

That was an entirely different situation. VW isn't a US business.

Re: AMD not vulnerable

"Probably made a mistake while copying Intel microcode."

It's not microcode. It's hardware hardware. Do pay attention at the back.

Proposed Brit law to ban b**tards brandishing bots to bulk-buy tickets

It's not an area that greatly concerns me but from the descriptions I've read here I'd have thought existing fraud legislation might have dealt with a lot of it and has the added advantage of imprisonment as a deterrent. But introducing a new piece of legislation is easier for legislators than getting existing legislation enforced. Which raises the question of how the new legislation will be enforced.

Re: Prioritising the priorites

Government is responsible a lot of areas and not all the public have the same concerns. If the entire government machine was obliging you, Stuart, by concentrating on what you think they should be doing there would be a lot of other people complaining about neglect of other issues such as Xylella fastidiosa or asking why you left climate change or whatever off your list.

Big shock: $700 Internet-of-Things door lock not a success

Re: What if ...

"The thing probably runs on easily-replaceable batteries."

So there you are, standing on your doorstep with a large economy pack of batteries in your hand swearing at your door that's locked and the battery box is on the inside.

Re: I'm disappointed

the concept isn’t nearly as outrageous or useless as a Bluetooth-enabled toaster

Re: Bah!

"nuanced access"

Maybe your problem is that this is an oxymoron.

Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign

"It depends on what's going on in a system."

Firing up top in Linux shows several processes, mostly daemons, actively using CPU with nothing actually being done with the system so even in the absence of IO there's context changes taking place even if it's just a matter of waking up daemons to find that there's nothing to do. I'd guess that much the same situation applies with Windows.

"Suggestions? Sincerely."

He's been pushing Talos. Providing they have a product in the format you need supported by the S/W you need...

Re: Phew!

"So you think the security problems in the world don't matter other than the influence of which processor you buy"

Focus. Tackle each issue in its own place. We've discussed other security issues in other contexts. Actually, in this context, the issue isn't so much the security issue, because like many others, it can be fixed, but the cost of fixing it.

Re: Genetic Diversity?

"So Gates would have still made a DOS for IBM."

Not "still made". Just "made" instead of "bought".

Re: Genetic Diversity?

"What would Intel be if IBM had picked a different processor for its PC back in 1981 (Motorola 68000?)?"

Z8000?

" If there was a CPU socket, the repair is simplified"

Never mind the quality feel the (lack of) width.

Re: How convenient

"When exactly did good sensible engineering go out the window in favour of marketing ideas"

Probably about the time model numbers were replaced by names.

Re: Can you hear it?

"Well, that just about wraps it up for blockchain mining!"

I'd have thought that something computationally intensive would be least affected as it would make fewer syscalls.