Downfall Attacks
What I find odd is that after the initial Spectre attacks, there have been a long string of these attacks discovered by outside researchers and then patched by the chipmakers.<p>In principle it seems like the chipmakers should hold all the cards when it comes to discovery: they are experts in speculative execution, know exactly how their chips work and have massive existing validation suites, simulators and internal machine-readable specifications for the low-level operations of these chips.<p>Outside researches need to reverse all this by probing a black box (plus a few much-worse-than-insider sources like patents).<p>Yet years after the initial disclosures it's still random individuals or groups who are discovering these? Perhaps pre-Spectre this attack vector wasn't even considered, but once the general mechanism was obvious did the chip-makers not simply set their biggest brains down and say "go through this with a fine-toothed comb looking for other Spectre attacks"?<p>Maybe they <i>did</i> and are well aware of all these attacks but to save face and performance hits they simply hold on to them hoping nobody makes them public?