Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
From the article:

For Apple customers, macOS and iOS devices have been patched with protection against Spectre and Meltdown. Meltdown was addressed in macOS High Sierra 10.13.2 and iOS 11.2, while Spectre mitigations were introduced in a macOS 10.13.2 supplemental update and iOS 11.2.2, both of which were released this week. The vulnerabilities have also been addressed in older versions of macOS and OS X.

Is this true? I've seen nothing to support this.

Agreed. Is there an official source for this statement? I have not seen anything.

The article says "The vulnerabilities have also been addressed in older versions of macOS and OS X." But where exactly is there a statement from Apple that says this is true? I have not yet seen one and which older versions have been updated. I've not seen a 10.6 update in years.

Come on @arn - where is the evidence for this ?
 
  • Like
Reactions: Wando64
You just contradicted yourself. First you seem to want us all to give Intel a free pass and not blame them nor should they fix their own problems. It should be Apple an others who fix it. Now you are saying oh wait others like Apple should not be held liable.
Which is it?
For your last part, I am not contradicting myself. I was replying to sentiment that an average employee in sales should be knowledgable in the impact of all vulnerabilities and fixes on performance of a product. That is really impractical, because there are so many fixes and vulnerabilities that it is really impossible to gauge, and keep track on a day to day basis. The guys in sales are not technical experts, and likely do not have the background to understand or properly respond to questions in this area. In a perfect world, everyone would be infinitely knowledgable on this subject, and they would be able to respond effectively.
You talk such BS.
The only reason these vulnerabilities slipped through is because Intel and companies like them think they are clever and intelligent and in a actual fact many people working for them are arrogant and dumb! They failed to check at all and security can be baked into hardware if you so see fit to and do so with the right approach.
Just look at the secure element in the iPhone 5s onwards.
You may say oh well how do we know that it is secure? We only have Apple's word for that plus if someone had cracked it they would not tell the world about it? They would exploit it, keep it secret.
So much like the person who discovered Apple's Root password bug in Mac OS? They kept it secret didn't they? oh and all the other bugs found in IOS/Mac Os etc?
[doublepost=1515758568][/doublepost]

It was negligence because Intel failed to check their products properly or at all. When I use to design and build PCs I did not just put the dam things together and hope for the bets, oh and then swan around telling everyone how my PC is the best around. How it is awesome and use many many but words and phrases.
I checked it, I did something called quality control.
At every step of the design and build process I would check, check and recheck. These vulnerabilities are not just some minor issue like you seem to suggest. They are major as they allow hackers the ability to basically gather a load of data that would be useful for further exploits.
I am tired of people like you making excuses for when firms as big as intel screw up and we are all expected to get on our knees and suck their ****s just to make you happy!

I say intel can not just shrug it's dam shoulders and say oh well and hey pretend it never happened.

Also not talking BS here. The fact that vulnerabilities can be continually mined out of software and hardware is a source of revenue for security research companies. This isn't exclusive to Intel, products from Apple, Microsoft, Google, and pretty much every tech firm under the sun have vulnerabilities in them to this day. The ongoing process of discovering those vulnerabilities is a job unto itself.

What makes it seem like I'm talking out of my ass is that you don't understand how these vulnerabilities are discovered. There's often a lot of time and effort during production time put into unit testing each aspect of code or a subcomponent of a processor. Often the firm doesn't have time to test every single possible case between the extreme edge cases, and the in-between cases can lead to unexpected output, that may or may not lead to a vulnerable state. If it leads to a vulnerable state, the firm is notified by the researcher / research firm and a patch is developed and then released to the public.

Want an example of a research firm? Zero Day Initiative. They are badass, and I have worked with them in the past.

Want to see examples of how many vulnerabilities are in the pipeline from just this firm alone?http://www.zerodayinitiative.com/advisories/upcoming/ - here there are 10 vulnerabilities for Apple products in the pipeline already.

You obviously had no understanding of the research community. I hope this enlightened you.
 
Looks like you completely missed the point of the bitcoin mention. Hint: it has nothing to do with investing in the actual crypto currency.

Comparing a stock to BitCoin is totally apples to oranges.

Even if your comparison was relevant, please show us another stock that has seen such growth in the same time.
 
So you are saying a new BIOS battery will fix the Intel slow down like Apple can fix the slowdown -- Interesting !!

They said the same thing after the 1940 Tacoma Narrows Bridge can down
and we have standing waves all the time now ------NOT !
 
2018 is the year of punishment for companies that have become large, greedy and complacent like Intel with Meltdown in the data centers and Apple with $2 glued-in batterie throttling cover-up. That's why it's important to have competition to put the fire in their pants and to fall back on.
 
Last edited:
Total PR stunt. The severity of these vulnerabilities does not warrant this kind of apology.

PR Stunt? I say more like PR blunder. Their next generation chips need to address the bugs at the hardware level. Else, his words are nothing but damage control
[doublepost=1515781061][/doublepost]
Intel needs to create a new architecture in order to solve this problem...

That won't fly. Intel won't abandon their "Core" based architecture. After all, the have invested heavily in it since its introduction in back in 2005.

Most likely they'll address the vulnerability directly on chip. Hopefully that's the case.
 
So in other words intel is saying "We screwed up BADLY! But we will not fix it and instead other companies whose fault it wasn't are forced to fix it, oh and we promise(as they keep their fingers crossed behind their backs)that future products won't be affected, despite the fact this has been going on for years and years"
[doublepost=1515758926][/doublepost]

Except that with the battery issue in iPhones that was Apple's fault because it was Apple's software that was at fault. Whereas in this case it is Intel's hardware and not Apple's fault. Stop giving Intel a free pass for screwing up so bad and not catching this for years and years!!!
[doublepost=1515759093][/doublepost]
I’m not giving anyone a free pass, Intel, Apple, HP, Dell, Lenovo, etc. Intel is at the root of the problem, but the others share some responsibility as well. They may have unknowingly sold a flawed product, but nonetheless they did sell it. If a supermarket sells you contaminated food, it may their supplier’s fault, but they still share responsibility because they were part of the chain from a legal perspective. Apple, HP and the others will have to deal with Intel when the time comes.

I know some people are looking at the potential negative consequences if Intel and potentially the others had to shoulder the full or even a significant portion of the burden, so perhaps for them the best outcome would be to accept the workarounds and hope that’s good enough. Grudgingly, I’m starting to believe the same. Maybe everyone will be entitled to a $50 or $100 discount off our next Mac or Windows PC, hopefully one with a redesigned Intel processor.
 
PR Stunt? I say more like PR blunder. Their next generation chips need to address the bugs at the hardware level. Else, his words are nothing but damage control
[doublepost=1515781061][/doublepost]

That won't fly. Intel won't abandon their "Core" based architecture. After all, the have invested heavily in it since its introduction in back in 2005.

Most likely they'll address the vulnerability directly on chip. Hopefully that's the case.

They HAVE TO ABANDON it. This is a hardware issue. What are you expecting? Without creating a new architecture, they will not able to solve this problem. For servers, it is a critical issue. Intel lost their credit for this. Firmware patch wont gonna last long. Even US gov. ordered to remove all Intel CPU to replace.
 
They HAVE TO ABANDON it. This is a hardware issue. What are you expecting? Without creating a new architecture, they will not able to solve this problem. For servers, it is a critical issue. Intel lost their credit for this. Firmware patch wont gonna last long. Even US gov. ordered to remove all Intel CPU to replace.

You do realize, by using Intel's Tick-Tock update schedule we have a new sub-architecture every two years right? That means, you can fix the issue via hardware without moving to an entire new prime architecture.
 
You do realize, by using Intel's Tick-Tock update schedule we have a new sub-architecture every two years right? That means, you can fix the issue via hardware without moving to an entire new prime architecture.

I know but they are still part of P6 architecture so it wont gonna makes any differences. Intel had been improving P6 for 22 years. What do you expect? Sub or micro-architectures are base on P6 architecture.

https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)

All CPU from 1995 are INCLUDED. Like I said without a new architecture like AMD Ryzen, they will face the biggest issues and they already lost reliability from Server.
 
I know but they are still part of P6 architecture so it wont gonna makes any differences. Intel had been improving P6 for 22 years. What do you expect? Sub or micro-architectures are base on P6 architecture.

https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)

All CPU from 1995 are INCLUDED. Like I said without a new architecture like AMD Ryzen, they will face the biggest issues and they already lost reliability from Server.

A new prime architecture is not needed. What really needs to happen is fixing the faults directly on chip via heavy R&D.
 
According to Krzanich, going forward, Intel promises to offer timely and transparent communications ...

Spectre and Meltdown impact all modern processors, including those used in Mac and iOS devices, and these two vulnerabilities will continue to be an issue for the foreseeable future as addressing them entirely requires new hardware design.

We'll see.

A software patch is one thing but the solid solution of reconfigured chips is a tougher proposition. I wonder how transparent they'll be in detailing the necessary lead times and probable release dates?

As I've mentioned before, I cannot see reconfigured chips in shipping computers before 2020, with that possibly optimistic.

In the meantime every customer should understand that they are purchasing compromised hardware. That it joins a large and sorry club by default is little consolation.

One could hope that Intel, Apple and others take this seriously and it marks the beginning of a renaissance in true computer security.
 
A new prime architecture is not needed. What really needs to happen is fixing the faults directly on chip via heavy R&D.

https://meltdownattack.com

They already mentioned that it is a hardware issue.

http://www.zdnet.com/article/why-in...future-depends-on-open-source-chips-meltdown/

This is one of the articles about creating a new architecture.

Like I said Meltdown is critical to P6 architecture and without making a new architecture, P6 architecture will still have the vulnerability.
 
I know but they are still part of P6 architecture so it wont gonna makes any differences. Intel had been improving P6 for 22 years. What do you expect? Sub or micro-architectures are base on P6 architecture.

https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)

All CPU from 1995 are INCLUDED. Like I said without a new architecture like AMD Ryzen, they will face the biggest issues and they already lost reliability from Server.

No need for a complete new architecture. Nothing wrong with it except for the found vulnerabilities. This can be fixed in the existing architecture. Don't forget that AMD, ARM (including Apple processors) and IBM have one or more of these vulnerabilities too. Should they all change their complete architecture?
Don't think so.
 
https://meltdownattack.com

They already mentioned that it is a hardware issue.

http://www.zdnet.com/article/why-in...future-depends-on-open-source-chips-meltdown/

This is one of the articles about creating a new architecture.

Like I said Meltdown is critical to P6 architecture and without making a new architecture, P6 architecture will still have the vulnerability.

Once again, a revision can be made to the current architecture via an Tock update. Why waste something like P6?
 
Intel CEO Pledges Commitment (*to his bank account) to Security Following Meltdown and Spectre Vulnerabilities

*FIXED
 
No need for a complete new architecture. Nothing wrong with it except for the found vulnerabilities. This can be fixed in the existing architecture. Don't forget that AMD, ARM (including Apple processors) and IBM have one or more of these vulnerabilities too. Should they all change their complete architecture?
Don't think so.
Once again, a revision can be made to the current architecture via an Tock update. Why waste something like P6?

You guys dont even understand about this issue. The P6 architecture itself is the issue since they enhanced it for 22 years. Dont you get it? Im talking about Meltdown at this point. For Spectre, AMD already fixed it so far. Also, without any proves from you, I have no reason to trust your sources. I already provided links for that.
 
You guys dont even understand about this issue. The P6 architecture itself is the issue since they enhanced it for 22 years. Dont you get it? Im talking about Meltdown at this point. For Spectre, AMD already fixed it so far. Also, without any proves from you, I have no reason to trust your sources. I already provided links for that.

I haven't posted any links or sources, so I don't know what you mean. Also, I know what I am saying. But let me put this into perspective by using analogies.

Ford came up with the EcoBoost engines with the 3.5 L EcoBoost for the Ford F150. That same engine is now used by 2 other models in the Ford line up. Furthermore, the 3.5 L engine has given rise to the 2.0L, 2.3L, 1.6L, 1.5L and 1.0L Ecoboost engines. Let's say tomorrow there is an issue discovered in the fuel-air mixture due to faulty design. The design can be fixed by applying a software patch to the engine computer (which many new cars have).

Would it be reasonable to scrap the entire EcoBoost engine line and start from scratch, or would it be reasonable to just fix the issue within the engine for next year's cars?
 
I haven't posted any links or sources, so I don't know what you mean. Also, I know what I am saying. But let me put this into perspective by using analogies.

Ford came up with the EcoBoost engines with the 3.5 L EcoBoost for the Ford F150. That same engine is now used by 2 other models in the Ford line up. Furthermore, the 3.5 L engine has given rise to the 2.0L, 2.3L, 1.6L, 1.5L and 1.0L Ecoboost engines. Let's say tomorrow there is an issue discovered in the fuel-air mixture due to faulty design. The design can be fixed by applying a software patch to the engine computer (which many new cars have).

Would it be reasonable to scrap the entire EcoBoost engine line and start from scratch, or would it be reasonable to just fix the issue within the engine for next year's cars?

A car engine is not even comparable with CPU. Totally wrong. Like I said all Intel CPU lineups are base on P6 architecture. are vulnerable because of CPU design since 1995. Why? Because they just ENHANCED it. Tick Tock strategy is not even related to new architecture since Intel enhanced it since 1995. If not, how come all Intel CPUs after 1995 are vulnerable to Meltdown while AMD Ryzen is not? Also, P6 was announced in 1995. The design itself for P6 architecture IS the problem. Fixing it wont be possible unless they make a new architecture. This already proven that other Intel's architectures such as Itanium and Netburst are NOT affected by Meltdown. Do you now see why P6 need to be replaced?
 
A car engine is not even comparable with CPU. Totally wrong. Like I said all Intel CPU lineups are base on P6 architecture. are vulnerable because of CPU design since 1995. Why? Because they just ENHANCED it. Tick Tock strategy is not even related to new architecture since Intel enhanced it since 1995. If not, how come all Intel CPUs after 1995 are vulnerable to Meltdown while AMD Ryzen is not? Also, P6 was announced in 1995. The design itself for P6 architecture IS the problem. Fixing it wont be possible unless they make a new architecture. This already proven that other Intel's architectures such as Itanium and Netburst are NOT affected by Meltdown. Do you now see why P6 need to be replaced?

Here is a quote (probably the essential one) from the same Wikipedia link you provided:

Impact[edit]
The impact of Meltdown depends on the design of the CPU, the design of the operating system (specifically how it uses memory paging), and the ability of a malicious party to get any code run on that system, as well as the value of any data it could read if able to execute.

  • CPU – Many of the most widely used modern CPUs from the late 1990s until early 2018 have the required exploitable design. However, it is possible to mitigate it within CPU design. A CPU that could detect and avoid memory access for unprivileged instructions, or was not susceptible to cache timing attacks or similar probes, or removed cache entries upon non-privilege detection (and did not allow other processes to access them until authorized) as part of abandoning the instruction, would not be able to be exploited in this manner. Some observers consider that all software solutions will be "workarounds" and the only true solution is to update affected CPU designs and remove the underlying weakness.

I refer to the bold sentences:
- First bold: It is entirely possible to mitigate it within the CPU design (= architecture).
- Second bold: the only true solution is to update affected CPU design (= architecture) and remove the underlying weakness.

Nowhere do I read that the whole architecture has to be dropped. An update and/or change in the existing design is sufficient. Why would you tear down a whole house when you only have to change a couple of doors and/or locks? You only tear down a house when the foundation is bad.
 
Last edited:
Here is a quote from the Wikipedia link you provided:

Do you see the bold sentences?
- First bold: It is entirely possible to mitigate in within the CPU design (architecture).
- Second bold: the only true solution is to update affected CPU design (architecture) and remove the underlying weakness.
Nowhere do I read that the whole architecture has to be dropped. An update and change in the existing design is sufficient.

It's already proven that it wont gonna work that way. Both Itanium and Netburst architecture does not have meltdown issues. Like I said, Intel P6 architecture was improving its design for 22 years so the basic issue wont gonna change even they update it.
 
It's already proven that it wont gonna work that way. Both Itanium and Netburst architecture does not have meltdown issues. Like I said, Intel P6 architecture was improving its design for 22 years so the basic issue wont gonna change even they update it.

Proven that it won't gonna work? According to your own link it should work perfectly.

You better give a source then. Since you are denying your own provided Wiki source now.

BTW I am fully aware that Itanium and Netburst architecture don't have that problem. But that does not mean that the old architecture can't be updated or patched. One does not exclude the other.
 
Source? Since you are denying your own provided Wiki source now. And I am fully aware that Itanium and Netburst architecture don't have that problem. But that does not mean that the old architecture can't be updated or patched. One does not exclude the other.
lol are you sure? I see your statement is wrong since wiki is updated today.

The quote from your link I showed you is from 30 minutes ago.

Wow that is fast. They added:
Some observers consider that all software solutions will be "workarounds" and the only true solution is to create a new architecture like AMD Ryzen series, Intel Itanium and Netburst architecture.

Some observers consider. Strong words on your side to call that prove. BTW a workaround still works within the current architecture. Maybe it is not ideal, but a workaround still works.

Ok lets meet in the middle: The current architecture is patcheable but not ideal (but it works), Itanium and Netburst are better in that respect.
 
Last edited:
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.