Why are Spectre and Meltdown So Dangerous?

[@tonydas999]

Why do vulnerabilities always get such cool names?

[@DerEwigeWanderer]

there was once a worm called "conficker". in german, "ficker" means "fucker" :)

[@potatopobobot4231]

Like aids?

[@Wonky2]

And why did they get such pretty logos?

[@TestiEsti123]

Probably the same reason as why storms get Human names. Easy to remember

[@ref3665]

Yeah, CVE-2018-7600 is a really cool name.

[@pmmoj33kristoferromanvilla48]

TechQuickie: “These affect almost every Intel CPU” Me at around 1:00 : “ah good thing I use AMD” TechQuickie 5 seconds later: “It also affects AMD CPUs” Me: NOOOOOO

[@giovannimaranzano292]

Progamerz 18 saaaaame

[@cockatoo010]

Meltdown doesn't affect AMD CPUs and 3000 series Ryzen CPUs include hardware mitigations against Spectre

[@freevbucks8019]

Yes but it's spectre. You're safe from meltdown

[@the_danksmith134]

Me: Haha Im on my phone!!! Techquickie 1 second later: ...and even Qualcomm CPUs Me: FUUUUUUUUU....

[@markind_007protocol7]

Good to update regularly if theres windows update available and read it first before update

[@1stfloorguy59]

It's a good thing my bank account is always empty

[@IV_Cornec]

1stfloorguy I feel ya

[@drmegaman]

fucking steam

[@rdln4313]

Dr Megaman more like fucking mundaine life shit to buy

[@drmegaman]

Lou D yeah, I said Steam because I thought that'd be funnier but it really is amazing how much little random stuff adds up

[@RettigJ]

That is normal. (For ~8/10 Americans -Dave Ramsey)

[@AlexanderPavel]

One important thing that was not mentioned: Meltdown (Intel specific) allows a program to read memory from anywhere on the CPU, included protected system memory. The 2 main spectre vulnerabilities can only read from the currently executing program or another program running in userspace (not system).

[@Matthigast]

You didn't give enough ram to chrome, ffs Linus!

[@JonatasAdoM]

He closed the tabs in chrome's task manager

[@dagg497]

Chrome 💕 RAM And the internet Tabs get super tiny with no text, so I'll never leave Firefox.

[@Hydr8Man]

Good thing my school uses MacBooks *AND CHROME* and the teachers are always wondering why the laptops are so slow

[@Ferotiq]

matthigast that’s every teacher but they only have 2gigs of ram XD

[@itsmetheherpes1750]

what the heck is specter and meltdown ?

[@moth.monster]

Wow, someone finally actually explained what the fucking bugs do. Thank you. I was getting tired of people just saying "Oh it's bad" and not actually caring about what it really does

[@m3talgame20]

you are more likely to encounter a dinosaur than a meltdown or spectre exploit

[@Mik-kv8xx]

@@m3talgame20 how do you know?

[@justacasualgamer1957]

@@m3talgame20 can you explain how

[@VeryBigExplosion]

@@m3talgame20 *Last Online 3 years ago*

[@m3talgame20]

@@VeryBigExplosion hmm old video it seems. I'd be more worried about china

[@lbsiuk]

Fun fact!: Early Intel Atom processors (the ones in netbooks from 2008-2010, like the n270 and n450) don't support speculative execution and therefore aren't vulnerable to Spectre/Meltdown.

[@Afif87123]

when its so bad that virus wont even bother to infect it

[@Ale-bj7nd]

The best CPUs ever made

[@ProcessedDigitally]

@bruh lol good one

[@PedroOjeda]

This was probably the best Techquickie video. I actually learned something instead of just getting a lot superficial knowledge

[@masoluboxD]

I think this is still superficial knowledge

[@joesterling4299]

I learned more about how the exploits work, but nothing to change my mind about how useless it is to obsess about them. Fact is we're screwed if anyone truly talented decides to come after our info. Vulnerabilities >>> Fixes for them

[@jeffbrownstain]

Really, because this was the most useless video I've watched yet. What does knowing how these work do for anyone that isn't working to fix them? I'd much rather learn all the discrepancies between file types than how a bug that will never effect 99% of people works.

[@mcrsit]

​@@jeffbrownstain You obviously didn't understand the video then.

[@jeffbrownstain]

mcrsit Year old video dude gtfo

[@aR0ttenBANANA]

i aint afraid of no ghost

[@uhoy1488]

aR0ttenBANANA96 GHOSTBUSTERS

[@SimGunther]

aR0ttenBANANA96 I ain't afraid of no sleep I ain't afraid of no bed

[@MC2738]

My server doesn't have this vulnerability, but my Gaming PC does :(

[@samwansitdabet6630]

Banking on server Fapping on battlestation Not that hard

[@simontay4851]

Who you gonna call...

[@RmwPathricc]

Meltdown and Spectre can also attack your phone processor Me : *laugh in nokia 3310*

[@the_danksmith134]

I hope they wont attack it cause that would cause a megagalactic explosion!!! Nokia 3310 is a serious weapon!

[@missingno2401]

nokia 3310 = the halo array dont do it, were all gonna die

[@JohnSmith-xq1pz]

Plz don't drop it

[@JohnSmith-xq1pz]

@@the_danksmith134 No kidding little known fact they powered both DeathStars

[@michakrzyzanowski8554]

@@JohnSmith-xq1pz linus shouldn't carry it

[@sidewinder3422]

As I expected Modern Technology is dangerous, nothing beats my old but realiable Abacus

[@Dragon22999]

Franz Tinuviel how bout them space probes orbiting jupiter?

[@estoor4258]

Comet Streak Probably just trash we found in space

[@taustyz5875]

Yeah but can it run Crysis

[@parasztj]

It is dangerous. Depends on acceleration.

[@lennon8435]

Abacus is a bit advanced for me

[@3420undertaker]

2:30 Google Chrome is inacurate it needs like THE WHOLE DAM BAR!

[@alfredoreconco]

I confirm as a Google Chrome user

[@SnowyRVulpix]

@Revali Which is a Chromium-based browser xD I think Firefox and Safari are the only ones that aren't Chromium now.

[@reckobot]

For me, who is using google chrome *with two tabs open*, I have discovered that google chrome uses up around a fat 780 mb of ram.

[@ms.magenta]

I cant relate to not having enough RAM for my browser, I use Edge.

[@ms.magenta]

somehow Microsoft did something right

[@cedricvelarde]

CPU: I can predict your next move. Spectre, Meltdown: Omae wa mou shindeiru CPU: *NANI?!*

[@FarmYardGaming]

*Rather loud melting sounds*

[@petarpartaloski8889]

As a guy who just had a subject dedicated to building processors from scratch, all of these terms seem very familiar to me, and I loved how well described the problems are in this video, just as always, Techquickie delivers!

[@virusboy07]

It’s not the same without tunnelbear

[@ray3990]

GerardoMjr what happened to tunnelbear

[@drmagnusw1238]

RayZr search we broke up.. linustechtips! he will tell you!

[@PixelVogue]

fcukin old fukin news!

[@yourick1953]

lets keep it here mcafee bought tunnelbear that should say enough

[@psych0536]

goddamn mcafee

[@herrreinsch]

*4:26** the barking cpu, I'm dead.* 😂

[@blackhatvisions]

normie

[@ZargAtHome]

BlackHat Visions REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

[@seppmartti]

I'm not sure what's going on, but: REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEST IN PEACE.

[@hypermangi8265]

BlackHat Visions REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEST IN PEACE.

[@kmical1564]

BlackHat Visions REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

[@remirms2239]

Lol, my name really is Jeff and I live in N.Y. I own an i7 4770k though, not an i5 4670k.😋

[@haas170]

Sure it’s not Rémi?

[@remirms2239]

Qyndryx Yeah because my Surname would be *Rooms* ...

[@Minecrafted907]

My name jeff

[@nicolasmunoz1847]

The whole schematic to explain the vulnerabilities is very well put together. Nice work!

[@Robo4720011]

This is one of the best readers digest explanations of the Spectre and Meltdown exploits I've seen so far. Bravo, Linus and the Techquickie team!

[@musmuk5350]

There's a hole in your T-shirt Linus :/

[@JRobert111111]

Or a stray piece of potato chip or some other food item.

[@Jmandude5]

Technically, all shirts have holes in them.

[@K34nuT]

mind blown

[@Czarcasm.]

I think that’s his microphone

[@Deekk]

Well duh that’s where his head, arms and body go in

[@JorgetePanete]

So, the CPUs are like: "Your next line will be..."

[@deki9827]

Oh ho

[@ashii_ii]

@@deki9827 josef joster

[@Kneedragon1962]

One consolation about Spectre & Meltdown. We've been hearing (a lot) about these vulns that will end life as we know it, but so far, (as far as I know), there has not been a single malicious example used in the wild, anywhere, any time, by anyone against anyone. The Y2K bug was lot more real and present and easy to demonstrate... I'm not saying they can't be used in the wild, but we've heard a hell of a lot about them, but after 4 or 5 months, there's still not been a single case of anyone catching gonorrhoea off a toilet seat.

[@bas7545]

Could you talk about the Cambridge analytica scandal?

[@zyyyper2459]

Bas 7 its more a political topic than anything else

[@TROONTRON]

We have all known about facebook selling our personal info for years, yet only now do people seem to care...

[@Shuvojit69]

It's just Facebook, Twitter selling data to a company that then does shit.. Thats what I understood 🙂

[@bas7545]

nigga what yeah that's true

[@SpartanDusk]

T.S that’s not the issue, it’s the fact that Cambridge will also take your friends info and sell it. It’s like your friend had sex with a skank and you got their aids as well. It’s probably worth for them but not for you

[@Twatical]

Checked my steam like 10 times whilst watching this video

[@EREMIT-DE]

Could you enlighten me? Also have Steam, just be online there once a month for new games. And then just single player rpg, as I am married 😂 Have no clue why someone even would go online on steam once a day...

[@NobbsAndVagene]

​@@EREMIT-DE Because they play a lot of games?

[@EREMIT-DE]

@@NobbsAndVagene Cool answer, so they play a lot of games and that is why they checking steam 10 times a day instead of playing a lot of games... so... if someone has a real answer... still no clue ^^ are you watching comments on games or have some forums I still not know about...?

[@Mugetsu_Gaming]

@@EREMIT-DE because the video had a lot of sound effects similar to that of which steam uses.

[@missingno2401]

bro i have no steam friends i dont have such weaknesses

[@Jan-vv1zk]

Hands down, this was pretty amazing. Great job, Linus.

[@kenstoudamire7366]

Cant expect an assembly spectre exploit in a 10 min vid

[@Techlifeandmore]

Since Spectre must ask the CPU repeatedly to execute the instructions, the CPU could take notice of this. It could then stop executing the instructions, investigate which program is doing so, and then delete Spectre.

[@stellanstafford6025]

It should use windows defender to notice it

[@frozenturbo8623]

@@stellanstafford6025 most OS don't have windows defender

[@feketetv]

a bit late, Linus

[@ReapeX]

better than never

[@PKGangsta18]

i think he is laying it out on Jump St for those who keep asking him what the exploits instead of googling it for themselves lol

[@CaveyMoth]

But at least his descriptions of the vulnerabilities are more detailed than in some other KZbinrs' videos.

[@NoNameAtAll2]

More like a byte

[@ko-Daegu]

Cavey Manta No one is better then ComputerPhile + There are mistakes in what CPU are vul ... go and read the sec paper or visit the website they layout the vul easily and you would know

[@windCR]

Solution: USE A INTEL i386 processor! (iT'S MADE BEFORE 1995 RIGHT? Or am I dumb? =/)

[@KWatson1984]

386 came out in late 1985. 1995 was Pentium Pro.

[@DJMavis]

Ah, 33Mhz.

[@frozenturbo8623]

@@DJMavis should be enough for the rtx 3070

[@tecker7454]

"[Spectre] will dump the information the attacker wants into cache" Cache as well as cash $$$ 😬

[@shudidesai]

Good job, can't imagine how hard this was to make, simplifying and compressing technical information like this is truly impressive. Give my regards to the script writer.

[@brentsnocomgaming7813]

Thank you for developing meltdown and spectre, NSA

[@matthewday7565]

Wasn't quite sure of the scope, whether it meant fishing with half a chance, or if it could target particular data. One thing that seems clear, the two vulnerabilities will not help to gain access initially, but could be used by malware that has already entered, or by a malicious user on a shared system

[@user-ok4pk2mp3e]

I was watching this on my newly bought Sceptre monitor and freaking out until I realized it's just an anagram.

[@hobomisanthropus2414]

Spectre is incredibly impractical to exploit. It can really only be used effectively against task-specific machines since the standard home user machine has so much junk data. This supposedly makes it a very useful exploit to steal hashing addresses and wipe out crypto wallets though. Enterprise servers that process payments are ripe targets as well.

[@gamboodle]

"Knock knock!" *Branch prediction* "Who's there?"

[@monkeywithocd]

6:25 - That really needs more explanation. Are you saying it would load into memory and then delete the executable, and then maybe put the executable back on the hard drive if it detected the system was being shut down?

[@rustyshackleford5166]

6:01 Speaking of plugging holes.....buttplu.....ahem....tunnel bear!! Wanna plug the holes where your ISP can peek at your data? Use a vpn to plug your data holes. LMAO!

[@burner887]

Russ Orler tunnelbear was bought by mcafee so no more tunnelbear ads lol

[@rustyshackleford5166]

Dadda Purple speaking of no more ads..... ADVERTISEMENT HERE!

[@thischannelwillselfdestruc4977]

its all pia ads now. Although I've started using IPVanish and am comfy.

[@LightStrikerQc]

This video forget a key thing; the data you can pick from those exploit is random and limited to a specific buffer size - which isn't very big even on the top of the line CPU. I haven't found any working implementation of those exploits, because there is no way to know what tiny chunk of data you got, and in what order you would need to reconstruct it - assuming you could get multiple different ones.

[@handymani4502]

The power of christ compels you - spectre the ghost flys out of pc -

[@doncosner2611]

This is the best explanation of these vulnerabilities I have heard! Nice job!

[@Matin_M]

Who thought their *Steam* was going off during this video? xD

[@canofbeans9455]

me :(

[@MWLLxUnderTaker]

My comp is protected by Drax! His reflexes are so fast nothing would go over his head!

[@sroku7673]

"Why are Spectre and Meltdown so dangerous?" Mindustry players: indeed they are

[@Mik-kv8xx]

Dont say the forbidden names!

[@pendingchange3776]

laughs in meltdown wall

[@martincaller1344]

laughs in infinite wall health

[@danielblack4190]

Actual question here: how do specter and meltdown know how fast certain data from certain memory addresses get loaded in if they don't have access to the data in the first place, and so, don't know when they would otherwise get it?

[@prowhiskey2678]

Great explanation!

[@tzint56]

glad i learned more about assembly and internal operations of a CPU. all of this makes a ton of sense. it's a way of deducting data at a memory address instead of asking for it directly (which will give a segmentation fault because the memory address it's asking for is outside of the program's "virtual memory", basically its partitioned area / sandbox that it plays in). seems to exploit cpu registers, wouldn't surprise me if this video explains it a little off just so that it's easier to explain. it'd be hard to write an assembly-level bug that utilizes any kind of inference of data, but then again it could probably be done in C, but i doubt it would be

[@V0TION]

4:21 Who else checked Steam??

[@xXConsmariosXx]

2:10 i checked steam xD

[@danielediedrichs8478]

It's not really the same Sound

[@DacLMK]

Change your name asshole

[@V0TION]

@@DacLMK no I don't think I will

[@DacLMK]

@@V0TION Change it, it disrupts scrolling on the page

[@xGatoDelFuegox]

Watching this after taran said he gave the malwares their own "personalities"...great touch :)

[@romulino]

photoshop using less ram than chrome? 🤣

[@TeamTeddy666]

4:20 I think I've done this before. Right after my PC turns on, if i try to open explorer, it won't open immediately because it just turned on. But, if I try to open it again, it immediately opens 2 windows of it. I'm not sure if this would fall into this "pattern" category, but It's something I noticed.

[@FireController1847]

that's just lag. you hit the button twice, so it will open two windows. if you hit it once, and wait, it will only open once.

[@tiosatria9919]

after you turn on your pc. your disk usage will reach about 100% that's because windows memory management, cache, and all that stuff to keep your windows running. because of that, you cant access your windows explorer immediately, there's alot of data to process. here's a tip : Replace your current hdd with ssd, this will solve your problem.

[@gereral1_jackofalltrades]

Spectre meltdown fix. Remove Internet lol

[@kepalaketukrandom7311]

No just use nokia 3310

[@HectorDomino.]

Thanks man, you have no idea how helpful your AFAP videos are. Cheers!

[@larrylentini5688]

You say I'll notice when my bank account is empty, but that's my secret. My bank account is *always* empty.

[@Right-Is-Right]

A smartphone trick is to close down all your programes already assigned ram by hitting the square on the left bottom of most devices and hitting the x on the right top of the pages that come up looking like open apps. It is often called closing your recnt apps but I wanted to wxplain it in a way a newbie should be able to understand.

[@chocobro7]

Welp, time to bust out the old 486!

[@sulphurous2656]

"Here's what you won't get on your 486!"

[@ShiroKage009]

There have been windows patches pushed it to essentially disable the gesture that enables the hole. It had a performance penalty in some applications, but it's not horrible.

[@1stfloorguy59]

Intel said the chips are working as designed though

[@samwansitdabet6630]

It is ABOUT to be patched.

[@m3talgame20]

Yes, they are working perfectly to NSA's specifications...

[@Teixas666]

in a sense they are the exploit is a result of a feature of all modern Cpu's, issue was that intel prefered ot leave ppl in the dark when they knew the issue was now exploitable

[@beaminyo_rblx]

Those noises from the viruses are enough to give me nightmares and make me not download anything off the web again...

[@dylanoonk6456]

2:26 this is totally unreasonable Linus! You're a tech person, I wouldn't thing that you of all people would make this mistake!! 1 ram stick per google chrome tab

[@a7medal-tell471]

This video is the best one about processor security

[@PeteSinHouston]

Brought to you by the good folks at the NSA (and the University of Wisconsin). A feature, not a bug.

[@antiseth3964]

Wrote a paper on this, so it's interesting to understand what he's talking about in this case. These flaws are game-changing for microarchitecture design.

[@prestonferry]

This was kinda a late video.

[@JohnCena-hu3jq]

People who made these are literally mad genius.

[@jumpierwolf]

Could those exploits be used on game consoles to run homebrew?

[@Ardkun00]

Yes, but it would require some customization.

[@HP97user]

no... that's not how any of this works... this is reading memory, not running an os

[@allanlansdowne340]

Only if you are connected to the internet.

[@kaiwenyu6519]

It is so clever to figure this bug out. So much fun understanding Meltdown!

[@xavierssounds3232]

Only one of you were first.

[@angelodou]

First

[@joeldeakin2003]

First

[@joeldeakin2003]

Galvatron I said it for a joke here

[@bibasik7]

*Blue shell*

[@joesterling4299]

6:22 - "All you can really do is be careful what you click on out there." That's all we can ever really do. (Well, sanitizing with script blockers also helps.) Security holes spring up faster than the plugs for them.

[@inidjilin]

Who the hell cares about someone being the first of a video

[@elgsquilliam]

The tech quickie intro is so good. I forgot about it, since I've been watching all vids in Floatplane

[@spectrefour2404]

I'm still wondering why my name was used for a security bug.

[@samwansitdabet6630]

Cus it sound cool

[@spectrefour2404]

Sam Wansitdabet that's why I picked it

[@spectrefour2404]

CommanderRE I also have an AMD processor. Coincidence?

[@SuperSaiyanNaruto2]

SpectreFour I think not.

[@gregbenwell6173]

About 12 years ago the company I worked at my former boss, had his credit account hacked, from a website he bought parts for a shop off of!!! Since then I ONLY USE prepaid credit cards online and NEVER use my own personal bank card or credit cards for transactions on the internet!!! For an extra layer of security I buy two or three prepaid cards and switch up which one I use every couple of months, and then when they are about to expire, I buy new prepaid credit cards!!! And when I DO use them I put just the money on them I need to make a purchase!! Call me paranoid, but it hasn't been an issue for me for almost 16 years now!!! In the end if you are buying $200 worth of stuff on eBay, then you keep $220 on the card (to cover any shipping and the cost of the items). Then in a lot of cases just before they expire you yank out your old cards use up the $5 balances before you use your next card!! It confuses the snot out of the hackers, because they see you are using 3 different cards for one purchase and not any of the numbers match!!! And ALSO use different four digit password numbers on each card as long as you can remember what the password is for each card it shouldn't be a problem and I write my last four card numbers down in a small note book, with the four digit pass code next to it, on my desk!!!! If you pick it up YOU CAN NEVER figure out what the 8 digit strings of numbers mean and without the security code number off the back of the prepaid credit card in most cases they are completely worthless as well too!!! Even if somebody steals the notebook!!! Like I say I might be a little paranoid, but this system has worked for me over the course of 16 years and NOBODY has ever hacked my bank account or run up my credit cards without my knowledge!!! So it DOES work!! And even if the hackers get your prepaid credit card number there is never a balance on them either until you are ready to actually use them, so they can't get anything either!!! And it only costs $5 to put money on the cards which is what I consider as money well spent for the "insurance value" of being secure!! And still in a pinch you can use the cards at ANY ATM without fear as well in case you need the money back off of them as well!!! So in most cases it is far more secure then ANY bank will offer you too!!! Lastly in a given month I use between 3 to 5 different prepaid cards, constantly switching between them randomly.....so this week I might use card number 1234 and card 4321, and card 2134 even on the same website!!! All are called out to my name......but my personal information on the prepaid cards are almost totally limited to just my name and address and not much more!!

[@marekvrbka]

*Laughs in AMD*

[@danielhn93]

Marcuss2 AMD master race

[@ivan______________________4002]

AMD budget race

[@somealtidklol3190]

*cries in coffee lake*

[@cicciobombo7496]

Hans Von Witzland that's still 50% less major vulnerability issues than intel

[@kataja34]

Laughs in RYZEN

[@geckoo9190]

So, if I understand well this is like those ram attacks before it was protected and randomized, but instead of just passing an addres, it tells windows to fetch the slippers.

[@dominikgoslawski627]

time to change my passwords to some 10 word sentences

[@Ardkun00]

Don't say that or attackers will know the method to crack you.

[@MLWJ1993]

Dominik Goslawski Problem is they get cached anyway...

[@ye_nope]

I feel like what the video is showing and what he is saying doesn't match properly which makes it really hard to understand what he was saying. So he says : -Meltdown request to read from a memory space used by another process -Cpu reads the content -Meltdown request to add a random value to the content and the result should be a memory address , but could that always be the case since its just a random number? -And how does the cpu even know that the result is an address ? As far as cpu concerned its just a result of that addition operation but not an address ?!! Am i missing something here ? please help out if so..

[@hedlund]

You may have done this already, but if not: I'd really love to see a vlog or WAN Show segment regarding these vulns. Aside from wanting your personal opinion(s) on the whole spectacle, I want to know if you've any tips for us, because I'm sure I'm not alone in having less-than-savvy relatives and friends who are damn near guaranteed to achieve said meltdown in record time, and I really don't know how to begin explaining this to them.

[@gigabyte128]

and no mention of the spectre microcode updates... well done linus..

[@donny6003]

Wow I'm impressed, this video actually got down into pretty technical subjects

well thats one of the reason i'm using adblock and pop up blocker you'll never know what ads on some website can harm your devices.

[@kayleighmoore6951]

1:19 But what about consoles and refrigerators?

[@as7river]

6:41 you can see he's ridiculously proud of the segway he just came up with.

[@trentonpaul6376]

woah this video is far better than the rest on this channel (I want to see more videos like this)

[@darkcreature9755]

Linus could you please make a video talking about differences between C++ and C# and which one is better.

[@anch95]

Why can the malware even analyse the timings on the CPU for commands it isn't supposed to(and can't) see?

[@FlameSoulis]

That just blows my mind. So even if I do something as simple as: if(false) {dothis()} it will still 'dothis()' even though the code literally renders it impossible because of the possibility of having to 'dothis()'?

[@Dakktyrel]

Both of these require a persistent threat that has already defeated any security features (AV, IDS, IPS) installed. So the threat is there...but if an attacker has already compromised your device or network....Spectre and Meltdown will be the hard way to get what they already have access to.

[@lordmarshmal_0643]

Being a guy that plays Mindustry, a Factorio-like game, I got confused like "Wait are we really analyzing these 2 end-game turrets" and I got dragged into just as informative a rabbit hole Mindustry V1 wasn't even a thing at the time this was uploaded, haha

[@StormyHotwolf88]

Very good explanation. The animation was good too ^_^. It's a shame the video kept stopping on me every few seconds, but I got through it!

[@thatdude6045]

thats insane how someone can just figure that out. theres hope for humanity because of the few geniuses we have out there

[@Elijah2]

At 4:22, “This guy really likes x+y” LOL! And the barking CPU

[@pokegamerXD]

So Spectre is a class of meltdown attacks or why does the article at 5:02 address speculative execution once again? They don't seem to mention the branch predictor though.

[@gFamWeb]

Thank you for actually explaining what it does in detail.

[@anasmohamad86]

Linus during the video:😐🙂 Linus during ads: 😄😁

[@seapeajones]

That squarespace segue was gold.

[@bigloudnoise]

If you have any old netbooks lying around from 2008-2011 or so, the models of Intel Atom processors those netbooks use are NOT affected by either Spectre or Meltdown. Just slap Linux on it to replace XP, and use that for the more security-sensitive tasks. That's one option, anyway.

[@letslike15]

You should take a Look at Branchscope, it's as devastating as Spectre but not mentioned in mainstream media for some reason.

[@sample-text]

Linus was so proud of that segue

[@maxxlr8tion578]

Can you explain the concept of mining here; where its value comes from, why its so popular, history, etc.

[@schunter20]

Why has this channel not tackled the important issues like slime and it's effectiveness as a thermal paste?