Year six opens with the most unsettling vulnerability disclosure I’ve ever read: Meltdown and Spectre. Not bugs in software, but bugs in the idea of modern CPUs. Speculative execution, the trick where processors guess ahead to go fast, turns out to leak secrets through timing side channels. Meltdown lets a process read kernel memory; Spectre tricks other processes into leaking their own; between them, essentially every Intel chip since the 90s and most others are affected. The fix costs performance (the cloud providers are rebooting the entire planet’s fleet this week, imagine that change-management ticket), and Spectre-class attacks will haunt chip design for a decade because the flaw is load-bearing: the speed we’ve enjoyed since 1995 was partially borrowed against an invariant nobody wrote down.
The disclosure drama is its own case study. The embargo was scheduled for the 9th, then broken by inference on the 2nd when people noticed suspicious Linux kernel patches merging with redacted comments. You cannot hide a fix in an open codebase; the diff is the disclosure.
My mental model updated permanently: the hardware is not a trusted substrate, it’s just the lowest layer of software, with the slowest patch cycle and the most optimistic assumptions. Turtles, downward, indefinitely.
TIL: cache-timing side channels, reading secrets by measuring how fast memory answers. The absence of data, timed precisely, is data. Somewhere a physicist is nodding; information leaks are conserved.