Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Not on ARM (Score 4, Interesting) 47

> The ARM reference design offers a guarantee that such side channels don't exist.

Nonsense. All modern CPUs have speculative execution side channels by nature. The only way to protect against these attacks is to change how we write software to insert speculation barriers in security-critical code paths.

The difference is that Intel doesn't just have speculative execution side channels, they had a pile of critical *security domain crossing* speculative execution side channels. All CPUs can leak data in speculation from your process into the side channel (which might be monitored by another process), but Intel has a pile of bugs which can leak data from *a completely different, innocent process*, or even the kernel (meltdown), or a VM hypervisor (L1TF). Those aren't inherent in CPU design, those are a result of what is clearly a major culture issue inside Intel.

> Spectre and Meltdown bed to differ.

Spectre and Meltdown are not covert channel issues. Spectre is a collection of speculative execution *side channel* issues, and Meltdown is a privilege domain crossing speculative execution *side channel* (the only one that hit other CPUs as well as Intel IIRC; other than Meltdown I think Intel has a monopoly on goofs this bad, e.g. L1TF). Covert channels are not the same thing as side channels, as they require cooperation from both sides.

Comment Re:Nice data [Re:Production, productivity] (Score 1) 68

You have half the picture. It was basic scientists, most importantly Norman Burlaug, "Father of the Green Revolution", that developed the high-yield, disease-resistant varieties of wheat that more than doubled and tripled agricultural production in Mexico, Pakistan, and India, allowing Mexico to become a net wheat exporter in 1963 and allowing Pakistan and India to avoid starvation. He literally saved billions of people from death via starvation and resource wars.

The reason Monsanto is hated is because the only thing they did was to commercialize these seeds by making them incapable of reproduction, thus allowing them to continue reaping profits off them year after year. This actively limits the seeds' usefulness for the sole reason of transferring wealth from poorer countries to richer countries.

It's the old, old story. Government funds basic research, taking on 99% of the risk and effort, for 1% reward. Private companies spin off the technology and commercialize it for 1% of the effort and 99% of the profits. Governments only tolerate it because it does after all make money for their respective economies, but this is why Big Agro and Big Pharma are so hated. Today it's playing out with Astra-Zeneca and Oxford.

If you want to remember a name, remember Norman Borlaug. He is the most deserving winner of the Nobel Peace Prize in the award's history. Read science fiction from the 1950s and see how much people worried that food insecurity would destroy the world. Without him our history would be utterly different and infinitely more miserable.

Comment Re:It's really not (Score 1) 287

I think you have an overly rosy view of how perfect human systems are. I'm an actual biomedical researcher and while I have not worked in a Level 4 facility, I can testify that animals never read textbooks and handling them can be unpredictable, and also that humans make mistakes and don't always play by the book.

But no need to hypothesize - a lab leak from the National Institute of Virology in Beijing already caused a SARS-like coronavirus outbreak in 2004 which killed one person.
https://www.cdc.gov/sars/media...

The researcher who got contaminated wasn't even working with SARS coronaviruses and we never found out how he got infected. Yet he went home, his mother caught it, and she died.

There were also leaks in 2003 in Singapore and in Taiwan:
https://www.who.int/csr/don/20...
https://www.cidrap.umn.edu/new...

Here is a good article outlining why we shouldn't be so quick to dismiss the lab leak hypothesis. Which, to be clear, is not the same as the engineered virus hypothesis, which is much less likely.
https://www.usatoday.com/in-de...

The PRC put a lot of pressure and restrictions on this WHO investigative team - I would put very little faith in the report. We'll probably never know. But they have not found any intermediate virus in dogs. In other words, they have not proposed a shred of evidence for their alternative hypothesis to the simplest credible alternative by Occam's razor - the lab leak.

Comment Re:It's really not (Score 1, Troll) 287

So what? It spreads very easily by air - all it would have taken would have been one safety violation, just a lab worker accidentally inhaling air in the same space as a bat infected with it. Given how unpredictable animal handling is at the best of times that's more "when", than "if".

To my mind, given that the closest relative of this virus in the wild lived in bats in a mineshaft 800km away, the Wuhan institute collected those bats for study, and the earliest community cases were in Wuhan, Occam's razor points to a lab leak as the likeliest explanation. Any other explanation has to explain how the 800km jump happened *without* the Wuhan Institute of Virology.

Comment Re:And if you do not run iSCSI, no problem. (Score 1) 94

Neither Facebook, where I used to work at, nor Google, where I currently work, use traditional virtual images with their own kernel, we use containers (borg/k8s at G and tupperware/twine at F). If you want to criticize our competence and say that we subscribe to a "prevalent defective mind-set"... ok. There is certainly no lack of investment in infrastruture at either of these companies. If you still feel like criticizing our competence, I invite you to instead apply and bring your energy to make things better. It is an enjoyable experience for anyone who takes a deep interest in systems or engineering.

Comment Re:And if you do not run iSCSI, no problem. (Score 1) 94

I dunno what to tell you man, that's not how system administration is done at any place with more than a few hundred machines - and wasn't even the way it was done at any of the smaller shops I worked at.

You make one golden build that covers all the various hardware generations and configurations that your system might have to interface with and then you distribute that to every machine in your fleet. You definitely don't make post facto changes like rm'ing unneeded kernel modules.

I think our disconnect is that you may be talking at the scale where system administrators log in to individual machines, i.e. a lot more babysitting of individual boxes. The maintenance operations that make sense at that scale can decrease your flexibility or your security or increase your maintenance burden at larger scales. Removing unneeded kernel modules at system startup, for example, or heck, even allowing system administrators to log on to a random box in production.

Comment Re:And if you do not run iSCSI, no problem. (Score 3, Insightful) 94

... i.e. 99% of systems out there, even in cloud and corporate. Yes, I've worked extensively on million-plus machine compute farms and there are a lot of drivers left in the golden builds that are not necessarily used.

When you installed your linux desktop, did you build your own kernel? Did you go through menuconfig for a few hours and unselect every hardware driver you didn't have on your machine at the time?

And when you plug in new hardware, do you first rebuild your kernel to include the driver so you can plug it in the following day?

Then congratulations, you are one of maybe 20 linux users on the planet who are not vulnerable. Enjoy your superiority. The rest of us normal humans are still worried.

Slashdot Top Deals

How many NASA managers does it take to screw in a lightbulb? "That's a known problem... don't worry about it."

Working...