A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 0:57 UTC (Wed) by AdamW (subscriber, #48457)
Parent article: A look at the handling of Meltdown and Spectre

Disclosure: I work for Red Hat, but wasn't involved in any early disclosure of this, for my role. So all I know is what I've heard/inferred from others. Of *course*, all of this is my personal opinion, and not all RH's official opinion or position, please don't read or cite it as such, I am in no position to speak officially on behalf of RH on this.

But without going into any specifics or anything I don't think I'm allowed to talk about, one significant point I've seen is that this has been a bit of an unprecedented situation.

The disclosure/embargo processes for vulnerabilities that can be addressed at a single point are, by now, pretty mature and well-understood, whatever you think of them, and people in general know how to follow them.

One reason why this one seems to have been a bit of a mess, it seems to be generally agreed, is that this was *not* a single vulnerability that could be addressed in a single piece of software, or by a single vendor. Insofar as there *was* a plan that multiple people/companies agreed on (again, this is just my reading of it), it seems to have involved at least multiple CPU manufacturers, OS vendors (counting commercial Linux distributors in that), cloud providers, hardware suppliers, and even higher-level software vendors, notably browsers. And probably more that I forgot about / don't know about. I rather suspect that the reasons behind some OS vendors/distributors apparently not being involved in the process is simple cock-up rather than conspiracy; I don't think there was a well-run authority somewhere with a Master List of people and companies who ought to get pulled into this, it was all being cooked up ad hoc.

Anyway, even without the ones who got left out, that's a *lot* of people and companies all with their own timeframes and agendas, all involved in a process that's really never happened before. And going by what I've heard, there wasn't really a common understanding beforehand of exactly how such a complex and lengthy embargo process ought to work. It seems to me like everyone had sort of a vague idea, but all the details were getting worked out as things went along.

So that would be an obvious source of confusion, and problems like articles that disclosed or implied the existence of the vulnerabilities getting published, and the mess with the KAISER patch set cluing people in that something was going on.

It seems like some well-intentioned folks are trying to kickstart efforts to try and improve how this sort of problem gets handled in future; let's hope those work out...

to post comments

A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 1:57 UTC (Wed) by pabs (subscriber, #43278) [Link] (2 responses)

There is a master list of OS vendors here and all of the people who were involved early should know about it:

http://oss-security.openwall.org/wiki/vendors

A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 7:14 UTC (Wed) by kay (guest, #1362) [Link]

yes, these are distro vendors, but linux kernel has no vendor and Linux kernel security list is not listed.

A look at the handling of Meltdown and Spectre

Posted Jan 12, 2018 2:03 UTC (Fri) by JdGordy (subscriber, #70103) [Link]

And my stupid work proxy blocks it!

"Your requested URL has been blocked by the Geolocation Filter. [REDACTED] business rule blocks access to sites in China (CN) and Russia (RU). "

awesome! :)

A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 12:23 UTC (Wed) by kiko (subscriber, #69905) [Link] (3 responses)

Thanks for sharing the RH perspective; we were also working flat-out at Canonical from the moment we were notified. In some ways, it's surprising how well this ended up being coordinated across the parties that had been notified; that the embargo only broke 6 days prior to the original date is also notable. It was definitely not ideal, but it could have gone a lot worse, and it shows the calibre and commitment of the people involved.

Parties that didn't get notified did get the short end of the stick, though. I don't know what can be done to improve that, perhaps other than better formalization of their relationships with the other major players in the security space (which for-profit distributors like us end up having as byproducts of our commercial engagements).

A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 15:19 UTC (Wed) by AdamW (subscriber, #48457) [Link]

You're welcome, but as I went to lots of pains to point out, that's *not* the RH perspective :) It's my perspective. I was not significantly involved in RH's response to this at all: I wasn't part of the embargo team and my entire contribution so far has been to help get some Fedora updates pushed promptly the day of the disclosure.

A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 18:47 UTC (Wed) by felixfix (subscriber, #242) [Link] (1 responses)

Thanks for sharing the RH perspective

Uh, NO. He went out of his way to say it was NOT the RH perspective.

Disclosure: I work for Red Hat, but wasn't involved in any early disclosure of this, for my role. So all I know is what I've heard/inferred from others. Of *course*, all of this is my personal opinion, and not all RH's official opinion or position, please don't read or cite it as such, I am in no position to speak officially on behalf of RH on this.

A look at the handling of Meltdown and Spectre

Posted Jan 10, 2018 18:47 UTC (Wed) by felixfix (subscriber, #242) [Link]

I see I should refresh more often and sooner :-O

A look at the handling of Meltdown and Spectre

Posted Jan 16, 2018 4:00 UTC (Tue) by ThinkRob (guest, #64513) [Link]

So if I'm reading this right, a fair summary would be that it's a massive problem that affects damn near everybody, everything is broken at every layer, and the scope of it makes a "perfect" coordinated announcement/fix an impossible exercise in cat-herding. :D

Kidding aside, thanks for a perspective from someone in the trenches. This whole thing seems like a complex and unpleasant issue, so props to everyone dealing with it!