discussion Intel bungles big time!

[Groove]

Exactly.

Yes you need a "malicious" software if you think about the issue being someone wanting to steal your personal data. What I meant was simply the fact that even "legitimate" applications may be privy to stuff they aren't suppose to see just by the way they handle data manipulated by the predictor.

 

[Marzipan]

software isn't malicious...people are malicious.

https://www.youtube.com/watch?v=seH3bsymNJ4

 

[Chilly]

I dunno if this has been posted here or not, but pretty interesting - graphs of performance hits experiences on various services;

https://imgur.com/a/zYRap

Looks like anything that heavily uses UDP, or high memory IO (PostgreSQL, redis, etc) is pretty badly hit

 

[Marzipan]

so, who's patched their BIOS' for these flaws?

 

[Lima]

been seriously considering going AMD since this news surfaced. Can use an upgrade anyway.. Safe bet?! what you guys think, pull the trigger?

 

[Marzipan]

AMD does suffer from some of these issues, despite their initial claim of not.

from the looks of it, almost every CPU made, is affected. the only one I haven't heard being affected is anything RISC. anyone know if RISC is affected by either of these flaws?

that said, as has been pointed out, regular computing and gaming have low single digit hits on performance, if any at all. it's only the high end server operations that really used the predictive technologies that have been hit, and even then it's the low double digits.

what will be interesting to see is whether the chip makers fix the bug in the architecture so they can continue to use the feature safely and without any sort of performance impact. h34r:

 

[Lima]

fix or new architecture will most probably come down to what will be easier/cost efficient am guessing

 

[Valkyrie]

Would the behavior of a malicious program that exploits this vulnerability not be easily detectable by AV?

 

[Marzipan]

that's a good point, Valkyrie...though I'm not sure what's necessary to exploit the vulnerabilities these two flaws have.

you would think, though, eh?

 

[stlouis1]

Would the behavior of a malicious program that exploits this vulnerability not be easily detectable by AV?

Let me ask the developers in our CZ office when I get to work, I'm sure they would have thought of this by now. (I work for a company that develops AV ;-) )

I imagine that updating virus definitions to detect something might be a problem if there are no known malicious variants in the wild though which could be a reason why we see no specifics from AV vendors on this yet. Hard to defend against something that doesn't exist yet.

Perhaps some behavior shield type protections that have more ties into the OS may be able to, but perhaps right now it's an unknown due to what I said above? I'm merely speculating though as it's beyond my level of expertise.