Kibbles & Bytes Blog

If you pay any attention to technology news, you’ve probably already heard of the recently discovered Meltdown and Spectre exploits that are reported to effect a majority of computer systems currently in operation, regardless of their operating system. Since the vulnerability is at it’s core, hardware-based, users of Macs, PC’s and some mobile devices are all at risk equally. The hardware in question are processors by Intel, AMD and ARM and the issue could be exploited in 3 ways known as Variants 1 and 2 (identified as Spectre) and Variant 3 (identified as Meltdown).

The way the Spectre exploit works is by taking advantage of the way your computer processor’s architecture is wired to execute code. In a very basic way, the processor’s job is to make a series of decisions very quickly and pass along the results of those decisions. To speed things up, most modern processors use a technique known as “branch prediction” to guess what the next decision it’s going to have to make is. This “speculative execution” greatly improves the speed of a processor as it can always stay a few steps ahead of the game. It’s not always correct in it’s predictions, but that doesn’t matter because the speed at which it does these predictions allows it to perform many, many of these per second.

In very simple terms, it’s all of these incorrect predictions that allow your sensitive data to be potentially revealed. When these bits of data are trashed, for just a moment, the state of your processor can be analyzed by some malicious agents and backtrack it’s way to what bits of data were used to arrive at it’s incorrect prediction. It can then exploit this method by making your processor arrive at incorrect predictions on purpose by injecting data far outside the bounds of what it expects and, in turn, grabbing more of your sensitive data with each execution.

Patches to guard against this involve an extra step every time your computer executes these kind of instructions, double checking to see if the data it’s executing lies within the bounds of what’s expected as well as separating the code and predictions into separate areas of memory. Different processor models have slightly different architectures and the exploits work in slightly different ways across them, however this is generally how things work.

Meltdown is much more clear-cut exploit. To run efficiently, data being run through different parts of your computer processor is stored in a cache as it’s passed between sections of your processor. Meltdown reads this cache and can take the information contained in it and send it off in another direction to be utilized for nefarious purposes. The fix for this involves splitting the address space for this shared memory so that the data is never complete and would appear as gibberish if it were captured, the downside to this fix is that it involves making your computer do twice the work for the same amount of processing. Fortunately, this type of shared memory space only occurs in an impactful way during specific I/O events such as disk-reads or network communication and has little effect on computationally-heavy computing such as video-editing or gaming.

New chipsets and operating-systems should be affected very minimally by any patches to eliminate these exploits, however older systems and certain cloud and virtualization computing systems could take a pretty big performance hit as they rely heavily on I/O to operate.

It’s not often that we see such a vulnerability so widespread and so tricky to fix. It’s something that has been baked into the core architecture of so many of our computer systems in slightly different ways and yet it exists almost universally between manufacturers. It’s like suddenly discovering that bare lightbulbs can steal your credit card number. Sure you can just say “use a lampshade” but lightbulbs come in different sizes and styles even though they all work pretty much the same way and even if you design a lampshade for every bare lightbulb out there, there will be slightly less light when fitted with a lampshade.

It’s a very rainy day here in Vermont, which is a little fitting for the way I feel today. Animals have a special way of taking hold in our hearts, and many of us find great comfort from having them in our lives. I think for anyone who has had pets in their life knows that unique bonds are formed with each one, and for some the bond runs deep. I’ve been around and owned horses for my entire life. I have bonded with several horses, but one horse holds a very special place in my heart, Skye. I am blessed to have been able to share 30 something years with this wonderful animal. I was able to grow as a rider thanks to him and in later years he helped my girls learn basic horsemanship. Yesterday I had to say goodbye to my lifelong friend and the grief over his loss is enormous. But, I have to keep moving forward. I have two other horses who need me and at the end of a long day, I can count on my pups, Piper and Tyson, to keep me company at night.

Don’s been out this week at CES. I’ve seen a few Facebook posts from the show and it seems robots are the big theme this year! I’ve had a hard time accepting the idea of drones, I can only imagine how long it will take me to adjust to robots taking care of people or as a partner in a round of scrabble! Thankfully, I’m confident in saying it will still be sometime before I have to be concerned over the idea of robots in my life. Who knows, maybe by the time that happens I will have become a fan of drones! Robots are happening right now, so I guess I need to get used to the idea! I’m looking forward to Don’s report on new products that will expand our home automation offerings, as well as other new product offerings to add to our Small Dog line up.

For this week’s Kibbles & Bytes exclusive I feel the need to crank it up! Music and movies really are a way to relax, focus or just take some time to distract your mind. I am a huge fan of my Sonos speakers for my music and movies. This week, I’m bundling a white Sonos Playbase with a pair of white Sonos Play 1’s. This trio of speakers normally costs $999.99. I’m making this bundle available to Kibbles & Bytes readers for $875.99!