CacheOut is the Latest Speculative Execution Attack for Intel Processors

[lexluthermiester]

So if AMD can do it with a tenth the budget does that make them awesome or Intel that shitty?

Flawed premise. You are assuming that the engineers are careless, that security testing was not done and that the qualification stage of R&D fails to double and triple check engineering samples.

These vulnerabilities are being discovered by methods the engineers never conceived of, let alone could have predicted and prevented.

 

[trparky]

You are assuming that the engineers are careless

I wouldn't go so far as to say that they were careless, I'd go more with the idea that they were rushed by upper management to push a product out faster with less validation.

I read a Reddit post that was written by a person who worked on the Centaur x86 chip. He mentioned that he knew people who worked at Intel back in 2014 and many of Intel's upper management wasn't happy with the engineering departments rather glacial pace at validating new hardware to be shipped to end-users so they pushed the engineering departments to go faster. Unfortunately, I think the whole industry is paying for that mistake right now. Slow and steady wins the race.

https://www.reddit.com/r/hardware/comments/ep0lf4/_/fenxd69
I don't know if I should believe fully in what that guy said but knowing how upper management of some companies is monumentally stupid I wouldn't put it past them for making such a stupid move. I fully believe in the idea of failing upwards. Those who can, do; those who can't, manage.

 

[R-T-B]

These vulnerabilities are incredibly clever, timing based vulnerabilities.

Think of it this way: in binary logic a cpu problem can only be true or false. A program makes a request for data it has no rights too. It is (correctly) told to screw itself. Thing is, someone figured out it takes slightly longer when the value is "false" for the processor to return the "fudge off" command. Guess what you can now reliably infer from that? Yep, the complete boolean. And you can do it again and again...

Would you have ever considered this as an engineer? It's basically the "I can tell when you are lying" problem in computer form.