RE: Intel CPU Design Flaw

[- S -]

4 hours ago, SrPx said:

If you have not been offered the security update, you may be running incompatible anti-virus software and you should follow up with your software vendor.

Let's hope is not one of those.... "only a few privileged ones" (read: highly paying or... of "family members") will (the antivirus companies) have the access to that.

I think the AV companies were caught off guard by the embargo being broken early before everything was in place.  HERE's an unofficial status of third-party AV's (many of them are still testing as the original schedule was to have it ready by next Tuesday).

However even with the Reg key already set and no third-party AV, I'm still not seeing the update through Windows Update and it has now gone past 6PM (GMT) which is when Microsoft usually push updates.  So I think there is something else in addition to third-party AV that's preventing them rolling it out to everyone at the moment.

 

3 hours ago, R C-R said:

The real problem is the news coverage. In the rush to 'scoop' the competition there is very little fact checking going on, a lot of speculation being reported as fact or foregone conclusion, & at best a half-hearted attempt at putting things in perspective. Particularly on web sites, they start using each other as sources, & within hours everybody is repeating the same, often out-of-date or incomplete or inaccurate stuff.

^ This.  It's a right mess.

[v_kyr]

Honestly I wouldn't recommend to play the too early adopter here for installing any OS patches etc., cause in the last time the OS vendors also messed up a lot of things with too early thrown out patches, especially when they were under stress due to massive press comments and reportings. So better give them some time to sort out things the right functional way, otherwise you might be left with a half-functioning system. 

[v_kyr]

Partly Intel and ARM list of affected processors, Nvidia is still analyzing:

• translated news article

 

Browser manufacturers respond to Meltdown and Specter with partly updates.

• Mozilla Firefox v.57.0.4
• Microsoft Edge, Internet Explorer (see the MS Win blog)

 

 

[v_kyr]

Apple has also commented on the chip gap in ARM and Intel processors.

• About speculative execution vulnerabilities in ARM-based and Intel CPUs

 

A good general technical info overview of Meltdown and Spectre vulnerabilities in modern processors can be seen on the Graz University of Technology website:

• Meltdown and Spectre

[R C-R]

2 hours ago, v_kyr said:

Apple has also commented on the chip gap in ARM and Intel processors.

So I guess this means I should update my OS from Sierra to High Sierra. 

[v_kyr]

5 minutes ago, R C-R said:

So I guess this means I should update my OS from Sierra to High Sierra. 

Just wait a little bit, the Mac related site I saw this info referenced said also ...

Quote

...More updates planned - including Safari

What is with older operating system versions - at least on the Mac, the company currently maintains even macOS 10.11 and 10.10 on - was not communicated. The Apple Watch should not be affected by Meltdown. In parallel, Apple also wants to seal its own browser safari - "in the coming days". Further countermeasures are planned in "coming updates" for iOS, macOS, tvOS and watchOS...

... so there might be chances they are also working on patches/updates for older OS versions. - For example I would like to see one then for 10.11.6 too.

[R C-R]

24 minutes ago, v_kyr said:

... so there might be chances they are also working on patches/updates for older OS versions. - For example I would like to see one then for 10.11.6 too.

I am not sure I want to wait & see what Apple might release for El Capitan or Sierra. What I will probably do is what I always do when upgrading to a new OS version: clone the current one to a backup drive, upgrade my normal startup drive & test the new version for any 'gotchas' that would make me less than thrilled about using it full time. I think I have only found one app that I could not upgrade or replace at little or no cost in the transition from El Capitan to Sierra (& that was a Solitaire card game I could easily do without), so I am hopeful the upgrade to High Sierra will be just as painless.

[v_kyr]

Well if your hardware is not restricted here due to possibly older build age, internal components and thus the overall max supported OS version for it, then there is no limit for you here to give it a try.

[v_kyr]

Another good and easy to follow explanatory read is this here:

• Analysis of the processor gap: Meltdown and Specter are a security supergau (English translation)

• Analyse zur Prozessorlücke: Meltdown und Spectre sind ein Security-Supergau (German original)

[R C-R]

3 hours ago, v_kyr said:

Well if your hardware is not restricted here due to possibly older build age, internal components and thus the overall max supported OS version for it, then there is no limit for you here to give it a try.

No problem with that for my 'Late 2012' iMac. 

 

For those wondering, according to MacTracker, the system requirements for High Sierra are:

Quote

iMac (Late 2009 or newer), or MacBook (Late 2009 or newer), or MacBook Pro (Mid 2010 or newer), or MacBook Air (Late 2010 or newer), or Mac mini (Mid 2010 or newer), or Mac Pro (Mid 2010 or newer), 2 GB of memory, 14.3 GB of available disk space, and OS X v10.8 or later

 

[R C-R]

This ArsTechnica article provides the most detailed, in depth discussion of the issue & what each affected company is doing about it that I have seen to date.

[v_kyr]

• Meltdown and Spectre: The safety notices and updates of hardware and software manufacturers (English translation)

• Meltdown und Spectre: Die Sicherheitshinweise und Updates von Hardware- und Software-Herstellern (German orginal)

[v_kyr]

On 4.1.2018 at 8:20 PM, v_kyr said:

Honestly I wouldn't recommend to play the too early adopter here for installing any OS patches etc., cause in the last time the OS vendors also messed up a lot of things with too early thrown out patches, especially when they were under stress due to massive press comments and reportings. So better give them some time to sort out things the right functional way, otherwise you might be left with a half-functioning system. 

I somehow knew from start up such things will happen ...

• Meltdown and Specter: Update for Windows 10 paralyzes some PCs (English translation)

[- S -]

2 hours ago, v_kyr said:

I somehow knew from start up such things will happen ...

• Meltdown and Specter: Update for Windows 10 paralyzes some PCs (English translation)

Yeah, kinda inevitable given the nature and scale of the issue.  I've been running a Skylake machine and a Broadwell machine since Friday with the Windows security update installed, but nothing eventful to report.

This morning I updated the Broadwell machine with new firmware containing updated CPU Microcode as well and that has been OK so far too.  I'm expecting new firmware to be available for the Skylake machine tomorrow.

 

[v_kyr]

Meltdown and Spectre: Microsoft Releases Testing Tool for Processor Vulnerabilities

• Microsoft has released a PowerShell module that lets Windows client and server systems tap into whether they are vulnerable to meltdown or Specter attacks

• Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities

[v_kyr]

Quote

Intel boss Brian Krzanich announced at the industry fair CES, to provide updates for Intel processors of the past five years, which are to close the security gaps Meltdown and Spectra. 90 percent of these processors will receive an update within the next seven days, the rest by the end of January.

• Meltdown and Spectre: Intel patched from 2013 produced processors, confirmed performance impact

Hmm, well Mr. Krzanich I still also have some older than 5 years Intel CPU based systems flying around here, what will happen with those...?

[SrPx]

The firmware update, quite an issue for those of us with more than arcane mother boards, lol... (a bunch of vendors wont give bios support to models that far away in time)

[v_kyr]

FAQ on Meltdown and Spectre: What happened, am I affected, how can I protect myself?

• English translation
• German original

[v_kyr]

"The ghosts I called... (the sorcerer's apprentice)" ...

• Meltdown and Spectre: Spontaneous restarts following updates from Intel's Haswell and Broadwell CPUs
• Intel benchmarks for Meltdown / Spectre: Performance drops by up to 10 percent, SSD I / O significantly more
• AMD rows back: processors affected by Spectre 2, microcode updates for Ryzen and Epyc coming soon

• Comment on Meltdown & Spectre: Chaos Instead of Customer Service

One has always to scroll down on the above translated info/news pages.

[v_kyr]

For those devs who use the MS Win C/C++ compilers ...

• Meltdown & Spectre: Microsoft's C/C ++ compiler protects against certain attacks (English translation, scroll down)

• Meltdown & Spectre: Microsofts C/C++-Compiler schützt vor bestimmten Angriffen (German)

[v_kyr]

• Meltdown: Apple delivers (finally) fix for older macOS versions

[R C-R]

From The Verge:

• Intel tells users to stop deploying buggy Spectre patch, citing technical issues
• Intel’s Spectre fixes are ‘complete and utter garbage,’ says Linux inventor
• Microsoft halts AMD Meltdown and Spectre patches after reports of unbootable PCs

As this Wired story says, the whole thing has pretty much been "a Total Train Wreck."