• Russia appears to be targeting journalists with spyware known as Pegasus.

  • Pegasus is a “zero-click” software, hacking phones by sending texts that don’t need to be opened.

  • The software has targeted dozens of journalists, activists, and politicians in recent years.

  • Dudewitbow@lemmy.ml
    link
    fedilink
    English
    arrow-up
    22
    arrow-down
    1
    ·
    10 months ago

    hardware based speculation is hard to patch compared to most exploits that are just bad programming mistakes due to two factors. one being its hardware and its hard to patch out hardware and 2. fixing it would lead to severe drop in performance. A name of a very recent one would be Retbleed.

    • masterofn001@lemmy.ca
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      5
      ·
      10 months ago

      Yet, if you check your dmesg you’ll find innumerable methods of mitigation against such exploits.

      A software patch for hardware issue.

      Personally, I’d rather the drop in performance than the Kashoggi treatment.

      • Dudewitbow@lemmy.ml
        link
        fedilink
        English
        arrow-up
        10
        arrow-down
        1
        ·
        10 months ago

        hence a preference thing, because In real life, when users see a huge performance drop, they complain (e.g Apple throttling old iphones due to aging battery without telling users). It’s why it’s one of the hardest fixes to do. Sometimes patches for speculation doesn’t hurt the end user much (e.g Zenbleed does not affect consumer loads like gaming) then you have situations like Intel’s Downfall, which has sizable AVX2/AVX512 performance penalties.

        • Serinus@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          2
          ·
          10 months ago

          It was absolutely not just for aging battery. It was also planned obsolescence.

          • Dudewitbow@lemmy.ml
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            10 months ago

            hence why it feels like that, but saying its the same situation again, some people would have prefer it for the phone to randomly shut off at 1-10% battery, and there’s the other camp that would have preferred for it to be throttled to prevent non zero shut down.

            Apples mistake was both not telling people about it publicly, and not giving them a choice.

        • Ottomateeverything@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          edit-2
          10 months ago

          because In real life, when users see a huge performance drop, they complain

          Yeah, true, and the dead people don’t get to complain, so just prioritize performance because the dead aren’t complaining.

          /s obviously. I don’t give a fuck how much performance you gain/lose by running an exposed system. Increasing road speed limits would help people get to work faster. But more of them would be dead. Road safety comes first, convenience and speed comes second.

          I could understand people having a slightly different priority list 30 years ago when performance was shit and computers were obscure. But in this day and age, we’re making increases in performance 99.9% of the populace won’t notice and computers literally run our lives. The priority is security.

          then you have situations like Intel’s Downfall, which has sizable AVX2/AVX512 performance penalties.

          Yeah, exactly. Most people don’t utilize AVX all that much. And those that do likely have newer machines that are unnaffected. And Intel is patching it.

          • Dudewitbow@lemmy.ml
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            10 months ago

            The point is, anything there is code speculation, virtually every single time they invent a new way to speed up performance, a new method of attack gets found. It doesnt matter if its Arm, it doesnt matter if its Apple, jt doesnt matter if its Intel, doesnt matter if its AMD, everyone has exploits as long as code speculation is a thing. If security is a severe issue, would the solution not be finding or using phones without code speculation period as as long as long as it exists, historyically speaking, its only a matter of time till an exploit exists for it.