Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> No, our interposer only works on DDR4

Not surprising - even having 2 DDR5 DIMMs on the same channel compromises signal integrity enough to need to drop the frequency by ~30-40%, so perhaps the best mitigation at the moment is to ensure the host is using the fastest DDR5 available.

So - Is the host DRAM/DIMM technology and frequency included in the remote attestation report for the VM?





Interposers exist for every type of memory.

We use them during hardware development to look at the waveforms in detail well beyond what is needed to read the bits.

The reason their interposer doesn't work with DDR5 is because they designed it with DDR4 as the target, not because DDR5 is impossible to snoop.


The mental image I'm getting from your description is a high speed o-scope probe copy-pasted 80 times, which would obviously be insane. But keysight docs show what looks like an entirely normal PCB that literally interposes the BGA with trace wires on every pin, which looks far too simple for a multi GHz signal.

What do they actually look like and are there teardowns that show the analog magic?


> The mental image I'm getting from your description is a high speed o-scope probe copy-pasted 80 times, which would obviously be insane

It's a thing. It's expensive though. At some point you copy-paste scopes and trigger sync them.

Edit: https://www.teledynelecroy.com/oscilloscope/oscilloscopeseri...


$157k starting price for a 4 channel is a bit rich for the kind of work I do.

100%.

I wonder if these are full sampling scopes. In the past we had Equivalent Time Sampling scope(wideband front end, fast sampling slow rate ADC, a variable delay trigger) and many buses have repeatable test patterns that let you trigger that way. They were always a fairly niche device.


They're not snooping, they're modifying the address dynamically to cause aliasing.

All of that info is faked. You should never trust a cloud vm. That is why it is called "public cloud".

The attestation report is signed by a key in the PSP hardware, not accessible by any OS or software, which can then be validated with the vendor's certificate/public-key. If that can be faked, are you saying that those private keys are compromised?

I'm willing to bet if you ran terrorism-as-a-service.com on a protected VM, it wouldn't be secure for long, and if it really came down to it, the keys would be coughed up.

> If that can be faked, are you saying that those private keys are compromised?

As I understand it, the big idea behind Confidential Computing is that huge American tech multinationals AWS, GCP and Azure can't be trusted.

It is hardly surprising, therefore, that the trustworthiness of huge American tech multinationals Intel and AMD should also be in doubt.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: