Year six opens with the most unsettling vulnerability disclosure I’ve ever read: MELTDOWN and SPECTRE. Not bugs in software — bugs in the IDEA of modern CPUs. Speculative execution, the trick where processors guess ahead to go fast, turns out to leak secrets through timing side channels. Meltdown lets a process read kernel memory; Spectre tricks other processes into leaking their own; between them, essentially every Intel chip since the 90s and most others are affected. The fix costs PERFORMANCE (the cloud providers are rebooting the entire planet’s fleet this week — imagine THAT change-management ticket), and Spectre-class attacks will haunt chip design for a decade because the flaw is load-bearing: the speed we’ve enjoyed since 1995 was partially borrowed against an invariant nobody wrote down.
The disclosure drama is its own case study — embargo scheduled for the 9th, broken by inference on the 2nd when people noticed suspicious Linux kernel patches merging with redacted comments. You cannot hide a fix in an open codebase; the diff IS the disclosure.
My mental model updated permanently: the hardware is not a trusted substrate, it’s just the LOWEST layer of software, with the slowest patch cycle and the most optimistic assumptions. Turtles, downward, indefinitely.
TIL: cache-timing side channels — reading secrets by measuring how FAST memory answers. The absence of data, timed precisely, is data. Somewhere a physicist is nodding; information leaks are conserved.