Hacker News new | past | comments | ask | show | jobs | submit login

I wonder if it might not come to bite them though. Doing it this way means that the media will constantly keep talking about yet another vulnerability in Intel CPUs for years. There's a chance that Intel might and up picking a reputation like Flash did for being insecure.

In this case, the FBI and SEC may need to investigate precisely what is going on. If Intel is doing partial fixes it knows of other things that aren’t being disclosed there could be criminal activity occurring.

Additionally, this had big implications for cloud providers. If additional liabilities of data leaks are foisted on companies, insurance companies and corporate counsel may just say no more using amazon, google cloud, azure, etc.

> here could be criminal activity occurring.

More likely some agencies don't want their exploits to stop working.

Which is sad... It wouldn't bug me nearly as much if they (NSA etc) had a sunset/disclosure policy of a reasonably short timeframe (say 60 days or so) for disclosure to the org that makes the software/hardware.

I can understand a state agency keeping a security flaw a secret to exploit in the near term... but stockpiling for years only to let stuff leak eventually is just irresponsible.

Note: I'm not saying that I like state sponsored hacking, only that I understand it being a reality and pragmatically wish they struck a better balance.

Or like java applet. Oracle has killed java applet by not handling security issues in a responsible manner.

Java applets died primarily due to the terrible user experience and inconsistent browser support. Security issues were less of a factor.

To be fair the entire approach was flawed and should have been abandoned in favour of SELinux plus something like seccomp years before.

Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.

How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...

seccomp actually has that ability to allow only small portion of selective operations.

Block everything except io is just one of its blocking mode.

And the list is even configurable. Docker do use such ability to filter out sys-calls that shouldn't be used in the container.


Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact