Hacker News new | past | comments | ask | show | jobs | submit login

AMD chips suffer from Spectre too (which is the hard to fix issue). They didn't really take any fewer "shortcuts" than Intel. And they weren't "shortcuts".



That’s highly misleading, and the very careful way that you worded your reply tells me that you know this. Why the obfuscation?


I am a phd researcher studying linguistics and deception. You mentioned the op was being misleading and communicated an understanding of the op's subversive intentions. Could you help me understand how op was being deceptive and how you knew based on their choice of language?

If you don't want to comment publicly and are still interested in helping me you can reach me at: gfair @ uncc.edu


I'm not OP but it comes from the fact that Spectre is a very specific bug, but is colloquially used to refer to all speculative execution bugs found after as well. So its true that AMD is susceptible to Spectre; However, the mitigations have a much lower effect on performance. Additionally AMD is not susceptible to the multitude of additional speculative execution bugs found in the time since Spectre was first announced.


Spectre was used to refer to all speculative execution timing leaks from the very beginning. That's why they called it "Spectre" - because it's going to be hanging over us for a long time.


I wasn't obfuscating anything. Spectre is a fundamental flaw that affects Intel and AMD processors.

Speculative execution is not really a "shortcut". Intel did make one shortcut but that resulted in Meltdown, which is easy to fix (conceptually anyway - I'm sure it was a lot of work!)

Any idea why I've been downvoted so much for saying something that surely everyone here remembers (wasn't that long ago) and is easily verified on Wikipedia:

https://en.m.wikipedia.org/wiki/Spectre_(security_vulnerabil...

> As of 2018, almost every computer system is affected by Spectre, including desktops, laptops, and mobile devices. Specifically, Spectre has been shown to work on Intel, AMD, ARM-based, and IBM processors.


Given that others also asked, I'll give a rundown of the discussion:

The context of the discussion was cpuguy83's suggestion that compared to AMD, Intel has been "suffering from shortcuts leading to Spectre/Meltdown and the performance regressions due to patching those".

cpuguy83's comment was very concise, so let me elaborate that the distinction between Spectre and Meltdown is essential here. Both are security flaws in CPUs that were published at the same time. Spectre is an industry-wide problem that also hit AMD, but "Meltdown" is the result of an Intel-specific implementation choice that I think one might fairly describe as a "shortcut". (Even IshKebab later agrees: https://news.ycombinator.com/item?id=21342048) Meltdown was also more immediately dangerous, and the software workarounds that were necessary to mitigate it in existing CPUs cost a lot of performance.

Given this context, I'll quote the relevant item from cpuguy83 again and then IshKebab's reply:

> cpuguy83: Intel [... has been ...] suffering from shortcuts leading to Spectre/Meltdown and the performance regressions due to patching those.

> IshKebab: AMD chips suffer from Spectre too (which is the hard to fix issue). They didn't really take any fewer "shortcuts" than Intel. And they weren't "shortcuts".

Note how IshKebab carefully ignores the Meltdown part of cpuguy83's comment to be able to claim that Intel hasn't been doing any worse than AMD, and that there were no shortcuts. For Spectre in the stricter sense, that's technically true. It's not true in the context of the entire Spectre/Meltdown event, which was cpuguy83's argument.


Isn’t the big performance hit because Intel wasn’t checking permissions where they should have? How is that not a shortcut? They skip a step for speed.


That’s Meltdown, not Spectre.

Meltdown arguably does fit your description, but AFAIK the cost of checking permissions in the right place is almost zero, so it’s arguably better described as “we never realized it would be dangerous to not check permissions here” than “we skipped the check for performance’s sake”. (AMD processors were not vulnerable to Meltdown.)

Spectre, on the other hand, is sort of an inherent flaw of speculative execution (not related to permissions checks). Speculative execution itself is definitely a shortcut, but it’s a shortcut that’s crucial to the performance of all modern high-performance processors, with the result that nobody really knows how to deal with Spectre. Intel was apparently hit harder than AMD by side channel mitigations collectively, apparently because Intel was doing more aggressive speculation – but those mitigations are only partial. Both vendors’ processors are still vulnerable to Spectre attacks even with mitigations applied [1], and that will remain the case even on future processors, for the foreseeable future.

[1] https://arxiv.org/abs/1902.05178


Contrary to popular sentiment, Meltdown is also not an Intel-unique bug, it also affected POWER and ARM processors.

AMD essentially got lucky on this one - their neural-network based branch predictor is difficult for an attacker to train to follow specific code paths, which is a necessary component of Meltdown/Spectre style attacks. Pretty much every other processor that does speculation is affected.

The potential for cache timing to serve as a side-channel leak was not widely appreciated in the industry, although it was theoretically described as far back as the early 90s.


Absurd to see this response flagged so heavily when it is correct on every point...


Given that I have the highest voted reply and several people asked, I've written a rundown here: https://news.ycombinator.com/item?id=21345820

Yes, the response is technically correct. But...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: