> Timing exploits has been known to the security community since the mid-nineties. From a real world standpoint the attack is not practical.
And this is basically the state of the art today, even with Spectre. You can demonstrate the vulnerability under controlled conditions but having those conditions arise in production is not practical in the engineering sense.
> Members of the IEEE commit, for example, "to hold paramount the safety, health, and welfare of the public..." without that duty being limited to hazards arising from projects employing the Engineer in question: The duty "to disclose promptly" vests in any Engineer who recognizes that the hazard exists.
As an active member of the IEEE for over a decade now, I have never seen anyone (aside from the author here) take this duty seriously. There are plenty of IEEE members working on things that directly cause such hazards.
> While I had some bills to cover — being a type 1 diabetic, I had to purchase insulin — living in Canada meant that I didn't need to worry about the risk of extraordinary costs from a hospital stay. Had I been living in the USA, I would have needed to prioritize seeking employment and medical insurance and likely would not have been able to discharge the duty which fate had thrust upon me.
It varies by state. Many states by now have programs capping it at 35$/mo, but I believe that often entails being insured under their state public insurance or another plan operating in that state (and so may not count as “uninsured cost”).
And what pray tell do you think modern academia is about?
I have trouble understanding why so many Hacker Newsies have such disdain for a class of people whose main objective in life is to discover and share knowledge, and have sacrificed tremendous amounts of their time, and potential money, to do so.
Intel's response was:
> Timing exploits has been known to the security community since the mid-nineties. From a real world standpoint the attack is not practical.
And this is basically the state of the art today, even with Spectre. You can demonstrate the vulnerability under controlled conditions but having those conditions arise in production is not practical in the engineering sense.
Wow that showed up quickly.
Readers might also consider my 2020 post "On the use of a life" to be an interesting companion piece: https://www.daemonology.net/blog/2020-09-20-On-the-use-of-a-...
> Members of the IEEE commit, for example, "to hold paramount the safety, health, and welfare of the public..." without that duty being limited to hazards arising from projects employing the Engineer in question: The duty "to disclose promptly" vests in any Engineer who recognizes that the hazard exists.
As an active member of the IEEE for over a decade now, I have never seen anyone (aside from the author here) take this duty seriously. There are plenty of IEEE members working on things that directly cause such hazards.
The Intel claim it wasn't a problem: [1]
Today, it would be a bigger deal. In the age of AI, exploiting hard to exploit holes is so much easier. AI has patience limited only by your budget.
[1] https://www.itnews.com.au/news/intel-soothes-hyperthreading-...
Linus said some silly things too. Fortunately the security and cryptography community mostly understood.
He sounds somewhat like R. K. Merton, and thus it was a good read.
> While I had some bills to cover — being a type 1 diabetic, I had to purchase insulin — living in Canada meant that I didn't need to worry about the risk of extraordinary costs from a hospital stay. Had I been living in the USA, I would have needed to prioritize seeking employment and medical insurance and likely would not have been able to discharge the duty which fate had thrust upon me.
God bless Canada.
He would’ve likely qualified for Medicaid in the US if he was living in any liberal state that expanded eligibility.
Federal requirements for Medicaid starting in January will result in large numbers of people losing coverage.
Q: How much does generic/biosimilar insulin cost in the US if you aren't insured? Does this vary by state?
It varies by state. Many states by now have programs capping it at 35$/mo, but I believe that often entails being insured under their state public insurance or another plan operating in that state (and so may not count as “uninsured cost”).
and if he was living in the other states?
That's a lot of asterisks for a gotcha. We need universal healthcare yesterday. We are barbaric.
[flagged]
I'm not sure modern academia has very much left to do with scholarship in the sense quoted in this article.
This is unfortunate.
And what pray tell do you think modern academia is about? I have trouble understanding why so many Hacker Newsies have such disdain for a class of people whose main objective in life is to discover and share knowledge, and have sacrificed tremendous amounts of their time, and potential money, to do so.
By revealed preference, modern academia is about churning incremental papers in order to obtain tenure and research grants.
There are whole disciplines whose telos is now activism rather than knowledge production.
https://cdn.vanderbilt.edu/vu-wpfsx/wp-content/uploads/sites...