This is among my favourite songs of all time, but until today I hadn’t seen the music video. This is one of the most adorable, wonderful things ever.
I started this blog and graduated high school in 2004, when this song came out. Norah Jones and Michael Franks got me through those final exams and assignments. It already seems like such a different world ago.
Given the fun the global IT community is having right now, felt it was as good a time as any to share this.
The Xen security team released XSA-254, with some more details about yesterday’s Intel revelations. This is the clearest explanation I’ve read about the mechanism of the exploit:
Processors give the illusion of a sequence of instructions executed one-by-one. However, in order to most efficiently use cpu resources, modern superscalar processors actually begin executing many instructions in parallel. In cases where instructions depend on the result of previous instructions or checks which have not yet completed, execution happens based on guesses about what the outcome will be.
If the guess is correct, execution has been sped up. If the guess is incorrect, partially-executed instructions are cancelled and architectural state changes (to registers, memory, and so on) reverted; but the whole process is no slower than if no guess had been made at all. This is sometimes called “speculative execution”.
Unfortunately, although architectural state is rolled back, there are other side effects, such as changes to TLB or cache state, which are not rolled back. These side effects can subsequently be detected by an attacker to determine information about what happened during the speculative execution phase. If an attacker can cause speculative execution to access sensitive memory areas, they may be able to infer what that sensitive memory contained.
I had to check Wikipedia what TLB was:
A translation lookaside buffer (TLB) is a memory cache that is used to reduce the time taken to access a user memory location. It is a part of the chip’s memory-management unit (MMU). The TLB stores the recent translations of virtual memory to physical memory and can be called an address-translation cache.
I’m a sucker for cute bird photos, so when I see one, I blog it. This was from the current Wikipedia article of the day earlier this week, taken by Greg Miles.
I appreciate the diet of these critters, and wish for some of them to spend some time with our local mosquitoes:
The red-backed fairywren mainly eats insects, and supplements its diet with seed and small fruit.
This originally appeared on the Annexe.
Not sure what this list was for, aside from the fact I love all of them. It is presented without any further order or comment.
John Leyden and Chris Williams have done excellent work reporting this news for The Register. Read it in full for all the details; I could barely believe it.
In short, 64-bit Intel CPUs leak protected kernel memory, and a microcode fix won’t be possible. Operating systems will have to be updated to mitigate it, which will incur a performance penalty.
AMD’s Tom Lendacky inadvertently provides the best summary:
AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault.
And Postgres’s Andres Freund gives an indication of the performance impact and worst case scenario. pti is page table isolation, the immediate software workaround:
pgbench SELECT 1, 16 clients, i7-6820HQ CPU (skylake):
pti=off: tps = 420490.162391
pti=on: tps = 350746.065039 (~0.83x)
pti=on, nopcid: tps = 324269.903152 (~0.77x)
This is hot on the heels of the latest Intel Management Engine problems.
There have been plenty of other issues since, but it does harken back to that Pentium F00F bug:
Due to the proliferation of Intel microprocessors, the existence of this open privilege instruction was considered a serious issue at the time. Operating system vendors responded by implementing workarounds that detected the condition and prevented the crash. Information about the bug first appeared on the Internet on or around 8 November 1997.
I still see mitigation lines against this in FreeBSD dmesg on my vintage MMX tower.
I’m rather partial to blogging. Problem is, I used to love it. There are several reasons I can think of, as opposed to divine from another source:
The new web sucks. Pages are bloated with gigantic downloaded web fonts and poorly written JavaScript that tracks us. Lightboxes are just popups in cheap suits. And employing full page background videos is basically a criminal offence.
Facebook and Twitter have eroded the sense of community the blogosphere used to have. Some just publish on Facebook, others start entire threads on Twitter, thereby negating the entire point of short character limits.
Remember when people used the term Blogosphere? What about Bloglines? The orange RSS icon? Or even Google Reader?
Most people I read no longer blog. Before comment systems ruined everything, we’d just link to each other and comment on our own blogs. I guess this is just a rehash of point 2.
To feel a bit better about the situation, I reproduced the last classic theme Rubenerd used before I tried making it look modern boring. It looks like a vintage blog again, which is visually terrible but far more fun!
Because if it’s not fun, what’s the point?
UPDATE: I’ve since been told an even better way.
I script as much as possible for Rubenerd, including image processing. This is how I’ve been concatenating images side by side for the longest time:
$ montage -border 0 \
-geometry x$_ORIGINALHEIGHT \
-tile 2x \
$_IMAGE1 $_IMAGE2 \
out.ext
But there’s an easier way!
$ montage -mode concatenate $_IMAGE1 $_IMG2 $_OUT
I don’t have an install to try in GraphicsMagick, but my hunch is its ImageMagick-specific.
More code or lines in your scripts are rewarding, but not half as much as being able to take lines out.
The following are the Listerine mouth washes I’ve tried over the last six months, in descending order of taste.
It shows how suggestible I am to colour. Green looks fresher and tastes better than purple, despite Total Care being more advanced.
As with all medical blog posts, the following cavities caveats apply:
This was not paid for by Listerine. If it were, they’d be disappointed to read me approving of Oral-B’s decent mouth wash products as well.
While important, taste should not be the primary consideration when procuring mouth washes. A cup of black coffee would be the winner in this case, which would be less than ideal for oral hygiene.
The filing of this post in hardware seems like a stretch.
Never take any medical advice from random blogs before consulting your qualified healthcare professional. I say qualified specifically, as an unqualified healthcare professional isn’t worth the mouth wash they probably drink. Which you shouldn’t.
Hi, how are you? I hope you had a wonderful holiday season, regardless of how you celebrate. For us, it was family time over Christmas, then NYE – as they abbreviate it now – introducing Clara to The Blues Brothers. It was glorious!
I had a new – well, technically old – blog theme I wanted to roll out in time for 2018, but there are still a few bugs. Clara has also updated the site mascot Rubi, and she looks amazing. She’ll be unveiled soon.
I don’t have too many specific goals for this year, but I’m looking forward to going to the AsiaBSDCon in Tokyo in March, and continuing to hone my skils in automation and technical writing. I’m also going to be a boss this year, that’ll take some adjustment!
Also, #PostADay2018 is on. I did it in 2011, let’s see if I can this year!
Cheers :).
Clara and I have spent much of our week off at Starbucks, for reasons:
Their Christmas Blend with rare aged Sumatra was a’ight. Colombian coffee is still my favourite, but Sumatran rates highly, even when Starbucks over-roasts them as they’re want to do.
Of note though, when I saved the above image from their WiFi hotspot, I saw the UUID for the image was prepended with the word “tactical”, which I have preserved in the filename here. That tickled me.