Researchers publish 5 new Spectre branches & 2 new Meltdown variants and demonstrate Meltdown running on Ryzen for the first time

[Sauron]

2 hours ago, firelighter487 said:

i'm not surprised. they and their fanboys were all like yes we're not vunerable. buy our cpu's. 

The question isn't about whether or not their chips are vulnerable (they were already considered vulnerable to the original spectre iirc) but whether or not the patch involves performance penalties. It does on Intel, so far it hasn't on AMD.

[porina]

Just last night I disabled the Windows enabled protections on my game system while I was diagnosing a performance problem. It didn't make a noticeable difference BTW so root cause is elsewhere.

 

I'm not surprised there will be more things discovered over time, but it remains a balance of risk vs cost.

[Doobeedoo]

Damn they're finding these every npw and then. 7nm Ryzen is said to have some hardware mitigations. But how they're finding these all the time, when will we have a CPU with complete hardware mitigations though. 

[Ashleyyyy]

1 hour ago, Sauron said:

The question isn't about whether or not their chips are vulnerable (they were already considered vulnerable to the original spectre iirc) but whether or not the patch involves performance penalties. It does on Intel, so far it hasn't on AMD.

oh okay. and they weren't vulnerable for meltdown right?

[Sauron]

8 minutes ago, firelighter487 said:

oh okay. and they weren't vulnerable for meltdown right?

Not the first variant, at least. Then again the names for these things are pretty confusing, there are a dozen or so meltdown variants with varying degrees of risk - this particular variant seems to require some sort of payload in an existing application that the user chose to run, so it's not as big of a deal as the original exploit which could pwn you through javascript on a random webpage without you ever knowing it.

[Ashleyyyy]

Just now, Sauron said:

Not the first variant, at least. Then again the names for these things are pretty confusing, there are a dozen or so meltdown variants with varying degrees of risk - this particular variant seems to require some sort of payload in an existing application that the user chose to run, so it's not as big of a deal as the original exploit which could pwn you through javascript on a random webpage without you ever knowing it.

through javascript!!!!???  

[Sauron]

1 minute ago, firelighter487 said:

through javascript!!!!???  

Yeah... it was bad.