Intel CEO Pledges Commitment to Security Following Meltdown and Spectre Vulnerabilities

[MadeTheSwitch]

Apple customers should make sure to keep their Macs and iOS devices up to date with the latest software to remain protected from malicious attacks that might take advantage of the exploits

What if your Mac or ios device cannot be updated further? Then what?

Or what if you don't want to lose access to older apps and programs? Shouldn't have to choose between running 32 bit apps and being patched for security. That is ridiculous.

 

[-BigMac-]

All those "commit" seem future tense to me, stating they have not been transparent, and committed to security of their users until now?

 

[Hanson Eigilson]

so intel cheated by allowing this backdoor and boosted performance over privacy compared to AMD and now it has come to bite them in the ass.

why is intel's CEO talk about mac os and ios patch as if he was the one that orchestrated the entire thing? tim should be taking credit about this instead of that crook.

can't believe he is still CEO with no repercussion. really goes to show that money can buy anything including your way out.

So many absurd posts, every single modern cpu manufacturer have problems severe problems with spectre vulnerabilities, including Apple and A11 processors, This is not intel specific. It is not possible for intel to patch this, they simply provide the hardware and it's up for providers of operating systems to take action, meaning Apple, Microsoft, Google and other's.

 

[HeresaThought]

"Because Spectre and Meltdown are hardware-based vulnerabilities, they must be addressed through software workarounds."
That's an interesting statement...

 

[Wando64]

From the article:

For Apple customers, macOS and iOS devices have been patched with protection against Spectre and Meltdown. Meltdown was addressed in macOS High Sierra 10.13.2 and iOS 11.2, while Spectre mitigations were introduced in a macOS 10.13.2 supplemental update and iOS 11.2.2, both of which were released this week. The vulnerabilities have also been addressed in older versions of macOS and OS X.

Is this true? I've seen nothing to support this.

Agreed. Is there an official source for this statement? I have not seen anything.

 

[Naaaaak]

Unless he puts his personal life savings / net worth on the line with this pledge, his commitment is empty. We know it's empty because he sold shares and added to his net worth before the 'vulnerability' became public.

Here's how you pledge Brian "NSA" Krzanich: Put your net worth in a trust and tie your distributions to a pledge that intelligence communities haven't compromised Intel hardware. If it's ever revealed that they have, you forfeit the remainder of the trust and instantly get fired by the board.

 

[Hanson Eigilson]

Agreed. Is there an official source for this statement? I have not seen anything.

good question, AFAIK Apple have not even released a white-paper on it, it's all press releases.

 

[mijail]

The stark truth is nothing in the digital realm will ever be truly safe. Ever.

No, the stark truth is that while features and marketing are prioritized over security, you will have security as an afterthought. Be it "digital realm" or your car or your home.

 

[WatchFromAfar]

Intel needs to create a new architecture in order to solve this problem. Software updates will only delay the time from getting hack. However, servers will suffer from this issue for several years while all servers using Intel CPU will suffer from the security vulnerability. At this point, it's really risky to use Intel CPU instead of AMD Ryzen. Do intel have technology and people to create a new architecture? NO. Intel had been modifying an old architecture since 1995 and never developed the new architecture to work with. It is a matter of time that Apple to switch CPU from Intel to AMD. Once again, using Intel CPU will still have security issues unless they make a new architecture. Switching CPU within Intel is meaningless since all Intel CPU after 1995 are included from this vulnerability.

All 64-bit x86 processors, including Intel's, are based on AMD designs. Intel tried to go their own way with 64-bit Itanium processors that were incompatible with 32-bit programs and they rightly died a death in the mid 2000's. AMD stepped-up to provide 64-bit architecture that's backwards compatible with 32-bit programs and that's what Intel and AMD are using today so why are you blaming Intel for this? you're using Intel processors based on an AMD design.

 

[shplock]

Won't hurt them in the long run. Their stock has been great and will continue to be.

It's not as if companies really have another option. Yes AMD exists but companies aren't going to switch everything over (and AMD was vulnerable too).

Few months from now people won't even be talking about this.

Intel now has lost it's credibility. It also keeps fudging up it's processor releases. it messed up Skylake and has been messing up since. So somehow I doubt that the stock is going to keep raising as fast as Bitcoin has.
A dumb corporation and AMD was affected but not nearly as bad as Intel was. Get your facts right!

 

[ChrisCW11]

I am already confident Intel has and is doing all it must to protect users. Within days of knowing about the issue I had patches from Dell, Microsoft and Intel to lock down my PC's and have experience no negative impact from the patches.

Its the REST of the industry what I do not trust. Apple, ARM and AMD were all smug an claimed immediately none of this had impact on their systems (at least with Apple not on their iDevice platform), and AMD just out and out lied that it didn't affect them. ARM hasn't even issued a statement that I am aware of, at least it hasn't made it into any new tech site.

What is also painfully obvious is that EVERYONE not Intel blatantly copied their architecture verbatim without even bothering to verify or evaluate that architecture before adapting it for their own purposes. This has been around for 20 or so years, yet Apple, ARM, AMD and I am sure anyone supporting the x86 instruction set dutifully copied the architecture. I don't blame all of them for cutting corners, but it took Google, a party not involved in CPU development of any sort, to find this issue while the entire CPU industry was oblivious to the exploit.

 

[shplock]

*puts on morpheus glasses* What if I told you that there are undoubtedly dozens of vulnerabilities like Spectre and Meltdown in your CPU right now? I guarantee you that there are, people just haven't discovered (or publicized) the vulnerability or how to exploit them. No amount of production-time checking will solve this issue.
[doublepost=1515715337][/doublepost]
They are not committing to anything they weren't already doing.

You talk such BS.
The only reason these vulnerabilities slipped through is because Intel and companies like them think they are clever and intelligent and in a actual fact many people working for them are arrogant and dumb! They failed to check at all and security can be baked into hardware if you so see fit to and do so with the right approach.
Just look at the secure element in the iPhone 5s onwards.
You may say oh well how do we know that it is secure? We only have Apple's word for that plus if someone had cracked it they would not tell the world about it? They would exploit it, keep it secret.
So much like the person who discovered Apple's Root password bug in Mac OS? They kept it secret didn't they? oh and all the other bugs found in IOS/Mac Os etc?
[doublepost=1515758568][/doublepost]

1) What about future processors ... - Yes. Those processors will likely have the fix. Though I wouldn't be surprised if it was two generations from now due to how intel works on their processor development lifecycle.
2) Should people not purchase any new Macs or Windows PCs ... - NO. This vulnerability is insignificant compared to the number of other fixes that impact your performance and get patched every month. Often optimizing code in one area will make the impact in a fixed area negligible. That is definitely going to be the case here.
3) Will there be compensation ... - Probably from a class action law suit somewhere. But I don't believe they should personally. This was not a case of negligence, this was a regular case of vulnerability discovery, research, and analysis.

It was negligence because Intel failed to check their products properly or at all. When I use to design and build PCs I did not just put the dam things together and hope for the bets, oh and then swan around telling everyone how my PC is the best around. How it is awesome and use many many but words and phrases.
I checked it, I did something called quality control.
At every step of the design and build process I would check, check and recheck. These vulnerabilities are not just some minor issue like you seem to suggest. They are major as they allow hackers the ability to basically gather a load of data that would be useful for further exploits.
I am tired of people like you making excuses for when firms as big as intel screw up and we are all expected to get on our knees and suck their ****s just to make you happy!

I say intel can not just shrug it's dam shoulders and say oh well and hey pretend it never happened.

 

[Stella]

This isn’t only an Intel problem.

Intel will be just fine.

No ‘creditability’ lost.

Bitcoin is a rollercoaster, BTW.

Every company has their issues. AMD has their’s - they can’t design CPUs that can compete with top end Nvidia products, for example. Apple has battery issues. On and on...

Intel now has lost it's credibility. It also keeps fudging up it's processor releases. it messed up Skylake and has been messing up since. So somehow I doubt that the stock is going to keep raising as fast as Bitcoin has.
A dumb corporation and AMD was affected but not nearly as bad as Intel was. Get your facts right!

 

[shplock]

"They" are not releasing any updates. Intel isn't patching this vulnerability, companies and organizations like Apple, Microsoft, and the Linux foundation are. All Intel did here was say 'Sorry, we'll fix it in upcoming products and keep doing what we're doing to fix the vulnerabilities that researchers find going forward.'

So in other words intel is saying "We screwed up BADLY! But we will not fix it and instead other companies whose fault it wasn't are forced to fix it, oh and we promise(as they keep their fingers crossed behind their backs)that future products won't be affected, despite the fact this has been going on for years and years"
[doublepost=1515758926][/doublepost]

So Ice Lake will be affected. Well, maybe for the sake of transparency, Apple, HP, Dell and other companies should make it clear to every person who purchases one of their computers that the Intel processor has this vulnerability and what steps they’re taking to mitigate the problem. They need to have a message pop up before each online purchase is completed describing the problem/mitigation steps. At physical stores, an employee will take the time to explain it and there will be the appropriate documentation describing the issue inside the packaging. That would be the right thing to do.

Except that with the battery issue in iPhones that was Apple's fault because it was Apple's software that was at fault. Whereas in this case it is Intel's hardware and not Apple's fault. Stop giving Intel a free pass for screwing up so bad and not catching this for years and years!!!
[doublepost=1515759093][/doublepost]

"Oh my sweet summer child..." - George RR Martin

Allow me to open your eyes to see the truth. Observe this sample security advisory, dubbed INTEL-SA-00086 https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

This is simply one of 86 security advisories that Intel has released. Each CVE reported in that advisory is a different vulnerability with it's own impact on performance of a Intel-based computer. An employee of Apple / Microsoft / any OEM should not be responsible for understanding the impact of each of these vulnerabilities.

You just contradicted yourself. First you seem to want us all to give Intel a free pass and not blame them nor should they fix their own problems. It should be Apple an others who fix it. Now you are saying oh wait others like Apple should not be held liable.
Which is it?

 

[Stella]

Maybe, Intel are not able to fix the code inside the CPU. That code may not be writable via the BIOS.

So the only option to fix the issue is via software at the OS level.

Have you thought about existing constraints before you type your diatribe?

[updated: post coffee, better English!]

So in other words intel is saying "We screwed up BADLY! But we will not fix it and instead other companies whose fault it wasn't are forced to fix it, oh and we promise(as they keep their fingers crossed behind their backs)that future products won't be affected, despite the fact this has been going on for years and years"
[doublepost=1515758926][/doublepost]

Except that with the battery issue in iPhones that was Apple's fault because it was Apple's software that was at fault. Whereas in this case it is Intel's hardware and not Apple's fault. Stop giving Intel a free pass for screwing up so bad and not catching this for years and years!!!

 

[Darmok N Jalad]

Not that vulnerable and AMD released firmware updates. They said ZERO impact.


Im talking about successfully created architecture. Itanium totally failed. Right now, servers are using x86 with Xeon CPU not Itanium. There is another architecture that Intel made: Netburst which is also failed. Now what, they are doom now.

Netburst was as much a “new” architecture as Bulldozer was for AMD. It was still based on x86 and had many of the same basic CPU components, but it chased clockspeed to gain performance. Quite a few Netburst features ended up in the Core architecture we have today. It actually was successful for a time (Northwood), but it couldn’t scale with process improvements.

 

[OldSchoolMacGuy]

Intel now has lost it's credibility. It also keeps fudging up it's processor releases. it messed up Skylake and has been messing up since. So somehow I doubt that the stock is going to keep raising as fast as Bitcoin has.
A dumb corporation and AMD was affected but not nearly as bad as Intel was. Get your facts right!

What in the world does BitCoin have to do with anything here? Anyone with any ounce of investment knowledge agrees it's a horridly stupid investment and doesn't represent any typical stock in any way. That example is completely irrelevant here.

Obviously you have no real argument to make as you've resorted to name calling. Let's just end this. Have a nice day.

 

[joema2]

As far as I understand it, AMD CPUs are only affected by Spectre V1, but Intel CPUs affected by Spectre V1, Spectre V2 and Meltdown....No Ryzen CPUs are affected by this...

That is not correct. AMD CPUs (including Ryzen) are affected by both Specter V1 and V2:

https://www.reuters.com/article/us-...riants-of-spectre-security-flaw-idUSKBN1F0314

Spectre and/or Meltdown also affects Oracle (formerly Sun) SPARC: https://sp.ts.fujitsu.com/dmsp/Publ...E2017-5715-vulnerability-Fujitsu-products.pdf

Spectre also affects IBM System Z mainframes, POWER8 and POWER9: https://access.redhat.com/security/vulnerabilities/speculativeexecution

Meltdown and Spectre affect certain ARM CPUs, including those used in the Nintendo Switch console: http://www.nintendolife.com/news/20...ctre_could_potentially_affect_nintendo_switch

Since the main criteria for Spectre vulnerability are (a) speculative execution and (b) branch prediction, it probably affects older RISC CPUs like the DEC Alpha 21264 and MIPS R10000: https://en.wikipedia.org/wiki/Alpha_21264

All of the above use out-of-order execution, speculative execution and branch prediction. Some CPUs use in-order speculative execution and branch prediction, such as the ARM A8, but are still vulnerable. A long list of ARM CPUs are affected, including A75, A73, A72, A57, A17, A15, A9, A8, R8, and R7: https://developer.arm.com/support/security-update

So CPUs with speculative in-order execution can be affected, not just the more common out-of-order type. While Intel's Itanium is mentioned as immune to Spectre, I'm not certain of that. Despite the VLIW in-order design, it heavily uses speculation and hardware branch prediction: https://en.wikipedia.org/wiki/Itanium

Itanium is a factor from a planning standpoint because the architecture is totally different from most other CPUs, yet it may still be affected. If so, this indicates how broad Spectre is and how fundamentally the problem must be approached from the standpoint of CPU redesign.

 

[Marshall73]

Wonder how much time the CEO will do for dumping his stock prior to this going public?

 

[ISanych]

Intel maybe not be able to directly fix the code in the CPU. That code may not be writable via the BIOS.

So the only option to fix the issue is via software at the OS level.

Have you thought about existing constraints before you type your diatribe?

Meltdown & Spectre could not be fixed by microcode change. Meltdown was fixed in kernels (and that's why we see performance impact for apps which do a lot of syscalls). Spectre was fixed (actually more workarounded than fixed) in browsers. Microcode could not do everything, Meltdown & Spectre require hardware changes, then software patches will be disabled for CPUs with hardware fix.

 

[Strelok]

What in the world does BitCoin have to do with anything here? Anyone with any ounce of investment knowledge agrees it's a horridly stupid investment and doesn't represent any typical stock in any way. That example is completely irrelevant here.

Obviously you have no real argument to make as you've resorted to name calling. Let's just end this. Have a nice day.

Looks like you completely missed the point of the bitcoin mention. Hint: it has nothing to do with investing in the actual crypto currency.

 

[O.N.Y.X]

Intel now has lost it's credibility. It also keeps fudging up it's processor releases. it messed up Skylake and has been messing up since. So somehow I doubt that the stock is going to keep raising as fast as Bitcoin has.
A dumb corporation and AMD was affected but not nearly as bad as Intel was. Get your facts right!

Ryzen was and still is a serious kick in Intel's groin. Intel has been on "red alert" since, trying to compete with overpriced and rushed products. Skylake is a good example: immature mainboards, insane power consumption, design flaws, ...

 

[Yvan256]

What if your Mac or ios device cannot be updated further? Then what?

Or what if you don't want to lose access to older apps and programs? Shouldn't have to choose between running 32 bit apps and being patched for security. That is ridiculous.

What if you can't upgrade because the fonts of the later versions of the OS are nearly unreadable on standard monitors? MacBook Air users and most Mac mini users do NOT have "retina" displays.

 

[MarcKerr]

The article says "The vulnerabilities have also been addressed in older versions of macOS and OS X." But where exactly is there a statement from Apple that says this is true? I have not yet seen one and which older versions have been updated. I've not seen a 10.6 update in years.

 

[MistrSynistr]

If you haven't gathered the data from the past year into collective, every single company you trust with keeping your information private has screwed you. If they didn't do that, they fixed your experience without your knowledge to undermine you.

Then, add the Wikileaks releases about the vulnerabilities (100% proven true, fyi) and all those "conspiracy theory kooks" turn out to be totally correct. This is the reality you live in now.