Meltdown and Spectre and DragonFly reddit / BSD ---------------------------------------------------------------------- [deleted] · 2018-01-05 22:53 Surprinsingly, Theo could forsee this 11 years ago already: https://marc.info/?l=openbsd-misc&m=118296441702631&w=2 ---------------------------------------------------------------------- cbmuser · 2018-01-06 00:22 They didn't foresee anything closely to Meltdown or Spectre. They said that the complexity of modern CPUs may introduce vulnerabilities through bugs which isn't really surprising. CPU bugs like Intel's FDIV already existed long before Theo made this statement. It's actually quite disappointing that an operating system like OpenBSD, that is so much focused on security, still hasn't had any statements made by their developers what the situation regarding these vulnerabilities is. ---------------------------------------------------------------------- JonathanZP · 2018-01-06 05:34 About Meltdown: https://marc.info/?l=openbsd-tech&m=151521435721902&w=2 ---------------------------------------------------------------------- piglit3 · 2018-01-06 06:45 I heard that some people were getting offers to sign NDAs for embargoed info as linux was already publicly patching and leaking info. Signing the NDA means agreeing not to fix it until a certain date while the information was apparently public. They figured working off the public info from Linux was good enough, but I don't think anyone guessed Meltdown. ---------------------------------------------------------------------- [deleted] · 2018-01-06 08:25 > They said that the complexity of modern CPUs may introduce vulnerabilities That's what I mean for "foresee". Yes, it's not that great surprise, and surely a genius wasn't required to make such a statement....yet he was brave enough to dare make such a statement against the tide of the time and that's what I'm talking about. I wouldn't expect OpenBSD devs to describe a fault affecting CPUs they hadn't come in contact with yet > It's actually quite disappointing... Again, I think we're getting our expectations too high. It's true they could have made an official statement, but if they haven't, it's because they don't want to admit such a security fault affects their system too. I'm sure something is going on under the hood, yet if they don't come out with a proper solution (something better than Linux 4.12.12) any time soon, I'm confident they'll confess this publicly ---------------------------------------------------------------------- [deleted] · 2018-01-06 08:25 Nice,thank you for sharing ---------------------------------------------------------------------- Mcnst · 2018-01-07 04:31 Come on, give us a break! This vulnerability was discovered 6 months ago by Google, and is/was under an NDA and an embargo, and OpenBSD is very well known for not doing NDAs, precisely because we like things like these to be in the public. OpenBSD team is small enough to not have a separate person doing processor-based vulnerability research 24/7, for free, may I add. So, sorry to disappoint you, but we don't have a psychics on the OpenBSD team. Or do you suggest that statements should be issued before the actual impact is fully understood?! By folks who only had a few hours to look into this, when others already had MONTHS for same?! Give us a break! ---------------------------------------------------------------------- UninsuredGibran · 2018-01-07 09:30 There is some drama going on in Linux and people like Greg KH are pissed at the way the whole thing was handled. Apparently they gave the information individually to a few important Linux vendors (i.e. Red Hat) and the distributions could not really collaborate with each other, and with upstream. ---------------------------------------------------------------------- Paspie · 2018-01-08 15:44 The OpenBSD project is focussed on finding flaws in itself, not something else.