Intel CPUs impacted by new PortSmash side-channel vulnerability
As predicted Spectre&#x2F;Meltdown were just the first fruit of a major new wave of investigations into these avenues of side-channel attacks in CPUs. Now we&#x27;re seeing more as it gets more attention, and it&#x27;s interesting stuff. That said I think the researchers might go too far here:<p>&gt;<i>&quot;This is the main reason we released the exploit -- to show how reproducible it is,&quot; Brumley told us, &quot;and help to kill off the SMT trend in chips.&quot;</i><p>&gt;<i>&quot;Security and SMT are mutually exclusive concepts,&quot; he added. &quot;I hope our work encourages users to disable SMT in the BIOS or choose to spend their money on architectures not featuring SMT.&quot;</i><p>I don&#x27;t blame them for being security focused about all else at any cost and any layer, that&#x27;s their gig. But I think the real response here is likely to be a lot more subtle and interesting. Of course perhaps SMT can in fact be fixed for this without a wholesale tossing in which case it&#x27;ll just be a universal hardware revision somewhere down the line. This increasing level of public research and awareness of this specific class is still relatively early days after all. But taking it as a given for argument that there really is a fundamental conflict, the fact would remain that SMT can provide significant performance gains, and furthermore that we&#x27;re still far from the point where SaaS&#x2F;IaaS is everywhere. Lots of systems are still under single user local control, and in turn attackers being able to co-run their own arbitrary code on the same physical core isn&#x27;t necessarily part of the threat model at all (and more specifically if attackers get that far least common denominator kicks in, they&#x27;ve already owned what&#x27;s important). Even if it&#x27;s desirable to run <i>some</i> risky code as well, hard core affinity for non-secure processes is a brute force solution in a local system context that seems like it shouldn&#x27;t be a big deal given the a surfeit of physical&#x2F;logical cores for many work loads.<p>But perhaps this could be a leading edge of true processor level physical differentiation required between IaaS and more traditional deployments, and that might make for an interesting change to the competitive landscape there. It&#x27;d change the cost&#x2F;benefit in some scenarios, or require more custom processor work to enact harder (and performance costing) boundaries that a traditional setup might take care of with machine isolation. I wonder if that could shift things back away from the Cloud and centralization trend in some instances, or at least create and more dynamic market?