<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" encoding="UTF-8" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:admin="http://webns.net/mvcb/" xmlns:atom="http://www.w3.org/2005/Atom/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:googleplay="http://www.google.com/schemas/play-podcasts/1.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:fireside="http://fireside.fm/modules/rss/fireside">
  <channel>
    <fireside:hostname>web02.fireside.fm</fireside:hostname>
    <fireside:genDate>Fri, 17 Apr 2026 04:59:50 -0500</fireside:genDate>
    <generator>Fireside (https://fireside.fm)</generator>
    <title>TechSNAP - Episodes Tagged with “Spectre”</title>
    <link>https://techsnap.systems/tags/spectre</link>
    <pubDate>Thu, 16 Aug 2018 16:30:00 -0700</pubDate>
    <description>Systems, Network, and Administration Podcast. Every two weeks TechSNAP covers the stories that impact those of us in the tech industry, and all of us that follow it. Every episode we dedicate a portion of the show to answer audience questions, discuss best practices, and solving your problems.
</description>
    <language>en-us</language>
    <itunes:type>episodic</itunes:type>
    <itunes:subtitle>Systems, Network, and Administration Podcast. </itunes:subtitle>
    <itunes:author>Jupiter Broadcasting</itunes:author>
    <itunes:summary>Systems, Network, and Administration Podcast. Every two weeks TechSNAP covers the stories that impact those of us in the tech industry, and all of us that follow it. Every episode we dedicate a portion of the show to answer audience questions, discuss best practices, and solving your problems.
</itunes:summary>
    <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/9/95197d05-40d6-4e68-8e0b-2f586ce8dc55/cover.jpg?v=4"/>
    <itunes:explicit>no</itunes:explicit>
    <itunes:owner>
      <itunes:name>Jupiter Broadcasting</itunes:name>
      <itunes:email>chris@jupiterbroadcasting.com</itunes:email>
    </itunes:owner>
<itunes:category text="News">
  <itunes:category text="Tech News"/>
</itunes:category>
<item>
  <title>Episode 380: Terminal Fault</title>
  <link>https://techsnap.systems/380</link>
  <guid isPermaLink="false">44b08775-8ecf-4c05-a1a7-a0888abfaadc</guid>
  <pubDate>Thu, 16 Aug 2018 16:30:00 -0700</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/95197d05-40d6-4e68-8e0b-2f586ce8dc55/44b08775-8ecf-4c05-a1a7-a0888abfaadc.mp3" length="27607345" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>Microsoft’s making radical changes to Windows 10, and a new type of speculative execution attack on Intel’s processors is targeting cloud providers.</itunes:subtitle>
  <itunes:duration>32:31</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/9/95197d05-40d6-4e68-8e0b-2f586ce8dc55/cover.jpg?v=4"/>
  <description>Microsoft’s making radical changes to Windows 10, and a new type of speculative execution attack on Intel’s processors is targeting cloud providers. 
</description>
  <itunes:keywords>Meltdown, Speculative Execution, Foreshadow, L1TF, Spectre, Page Tables, CPU, Intel, L1 Cache, L1 Terminal Fault, Cabot, Nagios, Windows, SMS, Two Factor Auth, Windows, Windows Console, ConPTY, InPrivate, PTY, SGX, Virtualization, Hyperthreading, sysadmin podcast, techsnap</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Microsoft’s making radical changes to Windows 10, and a new type of speculative execution attack on Intel’s processors is targeting cloud providers.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li></ul><p>Links:</p><ul><li><a title="Hanging Up on Mobile in the Name of Security" rel="nofollow" href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/">Hanging Up on Mobile in the Name of Security</a></li><li><a title="Windows 10 Enterprise Getting &quot;InPrivate Desktop&quot; Sandboxed Execution Feature" rel="nofollow" href="https://www.bleepingcomputer.com/news/microsoft/windows-10-enterprise-getting-inprivate-desktop-sandboxed-execution-feature/">Windows 10 Enterprise Getting "InPrivate Desktop" Sandboxed Execution Feature</a></li><li><a title="Introducing the Windows Pseudo Console (ConPTY)" rel="nofollow" href="https://blogs.msdn.microsoft.com/commandline/2018/08/02/windows-command-line-introducing-the-windows-pseudo-console-conpty/">Introducing the Windows Pseudo Console (ConPTY)</a></li><li><a title="Understanding L1 Terminal Fault aka Foreshadow" rel="nofollow" href="https://www.redhat.com/en/blog/understanding-l1-terminal-fault-aka-foreshadow-what-you-need-know">Understanding L1 Terminal Fault aka Foreshadow</a></li><li><a title="Merge L1 Terminal Fault fixes from Thomas Gleixner" rel="nofollow" href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=958f338e96f874a0d29442396d6adf9c1e17aa2d">Merge L1 Terminal Fault fixes from Thomas Gleixner</a></li><li><a title="Cabot: Self-hosted, easily-deployable monitoring and alerts service" rel="nofollow" href="https://github.com/arachnys/cabot">Cabot: Self-hosted, easily-deployable monitoring and alerts service</a></li><li><a title="cabotapp/cabot - Docker Hub" rel="nofollow" href="https://hub.docker.com/r/cabotapp/cabot/">cabotapp/cabot - Docker Hub</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Microsoft’s making radical changes to Windows 10, and a new type of speculative execution attack on Intel’s processors is targeting cloud providers.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li></ul><p>Links:</p><ul><li><a title="Hanging Up on Mobile in the Name of Security" rel="nofollow" href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/">Hanging Up on Mobile in the Name of Security</a></li><li><a title="Windows 10 Enterprise Getting &quot;InPrivate Desktop&quot; Sandboxed Execution Feature" rel="nofollow" href="https://www.bleepingcomputer.com/news/microsoft/windows-10-enterprise-getting-inprivate-desktop-sandboxed-execution-feature/">Windows 10 Enterprise Getting "InPrivate Desktop" Sandboxed Execution Feature</a></li><li><a title="Introducing the Windows Pseudo Console (ConPTY)" rel="nofollow" href="https://blogs.msdn.microsoft.com/commandline/2018/08/02/windows-command-line-introducing-the-windows-pseudo-console-conpty/">Introducing the Windows Pseudo Console (ConPTY)</a></li><li><a title="Understanding L1 Terminal Fault aka Foreshadow" rel="nofollow" href="https://www.redhat.com/en/blog/understanding-l1-terminal-fault-aka-foreshadow-what-you-need-know">Understanding L1 Terminal Fault aka Foreshadow</a></li><li><a title="Merge L1 Terminal Fault fixes from Thomas Gleixner" rel="nofollow" href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=958f338e96f874a0d29442396d6adf9c1e17aa2d">Merge L1 Terminal Fault fixes from Thomas Gleixner</a></li><li><a title="Cabot: Self-hosted, easily-deployable monitoring and alerts service" rel="nofollow" href="https://github.com/arachnys/cabot">Cabot: Self-hosted, easily-deployable monitoring and alerts service</a></li><li><a title="cabotapp/cabot - Docker Hub" rel="nofollow" href="https://hub.docker.com/r/cabotapp/cabot/">cabotapp/cabot - Docker Hub</a></li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 378: Two-Factor Fraud</title>
  <link>https://techsnap.systems/378</link>
  <guid isPermaLink="false">3ec742ee-24f7-4eee-a5a0-c40c5248e31b</guid>
  <pubDate>Thu, 02 Aug 2018 18:30:00 -0700</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/95197d05-40d6-4e68-8e0b-2f586ce8dc55/3ec742ee-24f7-4eee-a5a0-c40c5248e31b.mp3" length="27355773" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>Reddit’s Two Factor procedures fail, while Google’s prevents years of attacks. We’ll look at the different approaches, and discuss the fundamental weakness of Reddit’s approach.</itunes:subtitle>
  <itunes:duration>31:56</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/9/95197d05-40d6-4e68-8e0b-2f586ce8dc55/cover.jpg?v=4"/>
  <description>Reddit’s Two Factor procedures fail, while Google’s prevents years of attacks. We’ll look at the different approaches, and discuss the fundamental weakness of Reddit’s approach.
Plus a Spectre attack over the network, BGP issues take out Telegram, and more! 
</description>
  <itunes:keywords>Spectre, NetSpectre, Verizon leak, S3, NICE, BGP, Telegram, Duo Security, Cisco, Two-Factor Authentication, SMS, Sysadmin Podcast, TechSNAP</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>Reddit’s Two Factor procedures fail, while Google’s prevents years of attacks. We’ll look at the different approaches, and discuss the fundamental weakness of Reddit’s approach.</p>

<p>Plus a Spectre attack over the network, BGP issues take out Telegram, and more!</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li></ul><p>Links:</p><ul><li><a title="Hey, don&#39;t route the messenger! Telegram redirected through Iran by baffling BGP leak" rel="nofollow" href="https://www.theregister.co.uk/2018/08/01/bgp_route_leak_telegram_iran/">Hey, don't route the messenger! Telegram redirected through Iran by baffling BGP leak</a></li><li><a title="Finding and Diagnosing BGP Route Leaks" rel="nofollow" href="https://blog.thousandeyes.com/finding-and-diagnosing-bgp-route-leaks/">Finding and Diagnosing BGP Route Leaks</a></li><li><a title="Cloud Leak: How A Verizon Partner Exposed Millions of Customer Accounts" rel="nofollow" href="https://www.upguard.com/breaches/verizon-cloud-leak">Cloud Leak: How A Verizon Partner Exposed Millions of Customer Accounts</a></li><li><a title="New Spectre attack enables secrets to be leaked over a network" rel="nofollow" href="https://arstechnica.com/gadgets/2018/07/new-spectre-attack-enables-secrets-to-be-leaked-over-a-network/">New Spectre attack enables secrets to be leaked over a network</a></li><li><a title="NetSpectre: Read Arbitrary Memory over Network" rel="nofollow" href="https://arxiv.org/abs/1807.10535">NetSpectre: Read Arbitrary Memory over Network</a></li><li><a title="Password breach teaches Reddit that, yes, phone-based 2FA is that bad" rel="nofollow" href="https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/">Password breach teaches Reddit that, yes, phone-based 2FA is that bad</a></li><li><a title="We had a security incident." rel="nofollow" href="https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=JKBEHH8G&amp;sh=562ab497">We had a security incident.</a></li><li><a title="Google Employees Use a Physical Token as Their Second Authentication Factor" rel="nofollow" href="https://www.schneier.com/blog/archives/2018/07/google_employee.html">Google Employees Use a Physical Token as Their Second Authentication Factor</a></li><li><a title="Cisco is buying Duo Security for $2.35B in cash" rel="nofollow" href="https://techcrunch.com/2018/08/02/cisco-is-buying-duo-security-for-2-35b-in-cash/">Cisco is buying Duo Security for $2.35B in cash</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>Reddit’s Two Factor procedures fail, while Google’s prevents years of attacks. We’ll look at the different approaches, and discuss the fundamental weakness of Reddit’s approach.</p>

<p>Plus a Spectre attack over the network, BGP issues take out Telegram, and more!</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li></ul><p>Links:</p><ul><li><a title="Hey, don&#39;t route the messenger! Telegram redirected through Iran by baffling BGP leak" rel="nofollow" href="https://www.theregister.co.uk/2018/08/01/bgp_route_leak_telegram_iran/">Hey, don't route the messenger! Telegram redirected through Iran by baffling BGP leak</a></li><li><a title="Finding and Diagnosing BGP Route Leaks" rel="nofollow" href="https://blog.thousandeyes.com/finding-and-diagnosing-bgp-route-leaks/">Finding and Diagnosing BGP Route Leaks</a></li><li><a title="Cloud Leak: How A Verizon Partner Exposed Millions of Customer Accounts" rel="nofollow" href="https://www.upguard.com/breaches/verizon-cloud-leak">Cloud Leak: How A Verizon Partner Exposed Millions of Customer Accounts</a></li><li><a title="New Spectre attack enables secrets to be leaked over a network" rel="nofollow" href="https://arstechnica.com/gadgets/2018/07/new-spectre-attack-enables-secrets-to-be-leaked-over-a-network/">New Spectre attack enables secrets to be leaked over a network</a></li><li><a title="NetSpectre: Read Arbitrary Memory over Network" rel="nofollow" href="https://arxiv.org/abs/1807.10535">NetSpectre: Read Arbitrary Memory over Network</a></li><li><a title="Password breach teaches Reddit that, yes, phone-based 2FA is that bad" rel="nofollow" href="https://arstechnica.com/information-technology/2018/08/password-breach-teaches-reddit-that-yes-phone-based-2fa-is-that-bad/">Password breach teaches Reddit that, yes, phone-based 2FA is that bad</a></li><li><a title="We had a security incident." rel="nofollow" href="https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=JKBEHH8G&amp;sh=562ab497">We had a security incident.</a></li><li><a title="Google Employees Use a Physical Token as Their Second Authentication Factor" rel="nofollow" href="https://www.schneier.com/blog/archives/2018/07/google_employee.html">Google Employees Use a Physical Token as Their Second Authentication Factor</a></li><li><a title="Cisco is buying Duo Security for $2.35B in cash" rel="nofollow" href="https://techcrunch.com/2018/08/02/cisco-is-buying-duo-security-for-2-35b-in-cash/">Cisco is buying Duo Security for $2.35B in cash</a></li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 369: Another Pass at Bypass</title>
  <link>https://techsnap.systems/369</link>
  <guid isPermaLink="false">c9e44cac-c711-4e40-a417-2d0ecc5712e7</guid>
  <pubDate>Wed, 23 May 2018 14:00:00 -0700</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/95197d05-40d6-4e68-8e0b-2f586ce8dc55/c9e44cac-c711-4e40-a417-2d0ecc5712e7.mp3" length="38084184" type="audio/mp3"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>We’ll explain how Speculative Store Bypass works, and the new mitigation techniques that are inbound. </itunes:subtitle>
  <itunes:duration>44:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/9/95197d05-40d6-4e68-8e0b-2f586ce8dc55/cover.jpg?v=4"/>
  <description>We’ll explain how Speculative Store Bypass works, and the new mitigation techniques that are inbound. 
Plus this week’s security news has a bit of a theme, and we share some great war stories sent into the show. 
</description>
  <content:encoded>
    <![CDATA[<p>We’ll explain how Speculative Store Bypass works, and the new mitigation techniques that are inbound. </p>

<p>Plus this week’s security news has a bit of a theme, and we share some great war stories sent into the show.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li></ul><p>Links:</p><ul><li><a title="Security Flaw Impacts Electron-Based Apps" rel="nofollow" href="https://www.bleepingcomputer.com/news/security/security-flaw-impacts-electron-based-apps/">Security Flaw Impacts Electron-Based Apps</a></li><li><a title="Attackers Use UPnP to Sidestep DDoS Defenses | Threatpost | The first stop for security news" rel="nofollow" href="https://threatpost.com/attackers-use-upnp-to-sidestep-ddos-defenses/131981/">Attackers Use UPnP to Sidestep DDoS Defenses | Threatpost | The first stop for security news</a></li><li><a title="Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext" rel="nofollow" href="https://thehackernews.com/2018/05/signal-desktop-hacking.html?m=1">Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext</a></li><li><a title="Critical Linux Flaw Opens the Door to Full Root Access | Threatpost | The first stop for security news" rel="nofollow" href="https://threatpost.com/critical-linux-flaw-opens-the-door-to-full-root-access/132034/">Critical Linux Flaw Opens the Door to Full Root Access | Threatpost | The first stop for security news</a></li><li><a title="Microsoft, Google: We&#39;ve found a fourth data-leaking Meltdown-Spectre CPU hole • The Register" rel="nofollow" href="https://www.theregister.co.uk/2018/05/21/spectre_meltdown_v4_microsoft_google/">Microsoft, Google: We've found a fourth data-leaking Meltdown-Spectre CPU hole • The Register</a></li><li><a title="Speculative Store Bypass explained: what it is, how it works" rel="nofollow" href="https://www.redhat.com/en/blog/speculative-store-bypass-explained-what-it-how-it-works">Speculative Store Bypass explained: what it is, how it works</a></li><li><a title="TechSNAP Episode 351: Performance Meltdown" rel="nofollow" href="http://techsnap.systems/351">TechSNAP Episode 351: Performance Meltdown</a></li><li><a title="Dave&#39;s Users flip the switch!" rel="nofollow" href="https://pastebin.com/LKVFaUYp">Dave's Users flip the switch!</a></li><li><a title="Dave&#39;s War Story is really Screwy!" rel="nofollow" href="https://pastebin.com/tsfjKEhb">Dave's War Story is really Screwy!</a></li><li><a title="Egon&#39;s Adventures in misslabled VMs" rel="nofollow" href="https://pastebin.com/wg4y034g">Egon's Adventures in misslabled VMs</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We’ll explain how Speculative Store Bypass works, and the new mitigation techniques that are inbound. </p>

<p>Plus this week’s security news has a bit of a theme, and we share some great war stories sent into the show.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li></ul><p>Links:</p><ul><li><a title="Security Flaw Impacts Electron-Based Apps" rel="nofollow" href="https://www.bleepingcomputer.com/news/security/security-flaw-impacts-electron-based-apps/">Security Flaw Impacts Electron-Based Apps</a></li><li><a title="Attackers Use UPnP to Sidestep DDoS Defenses | Threatpost | The first stop for security news" rel="nofollow" href="https://threatpost.com/attackers-use-upnp-to-sidestep-ddos-defenses/131981/">Attackers Use UPnP to Sidestep DDoS Defenses | Threatpost | The first stop for security news</a></li><li><a title="Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext" rel="nofollow" href="https://thehackernews.com/2018/05/signal-desktop-hacking.html?m=1">Another severe flaw in Signal desktop app lets hackers steal your chats in plaintext</a></li><li><a title="Critical Linux Flaw Opens the Door to Full Root Access | Threatpost | The first stop for security news" rel="nofollow" href="https://threatpost.com/critical-linux-flaw-opens-the-door-to-full-root-access/132034/">Critical Linux Flaw Opens the Door to Full Root Access | Threatpost | The first stop for security news</a></li><li><a title="Microsoft, Google: We&#39;ve found a fourth data-leaking Meltdown-Spectre CPU hole • The Register" rel="nofollow" href="https://www.theregister.co.uk/2018/05/21/spectre_meltdown_v4_microsoft_google/">Microsoft, Google: We've found a fourth data-leaking Meltdown-Spectre CPU hole • The Register</a></li><li><a title="Speculative Store Bypass explained: what it is, how it works" rel="nofollow" href="https://www.redhat.com/en/blog/speculative-store-bypass-explained-what-it-how-it-works">Speculative Store Bypass explained: what it is, how it works</a></li><li><a title="TechSNAP Episode 351: Performance Meltdown" rel="nofollow" href="http://techsnap.systems/351">TechSNAP Episode 351: Performance Meltdown</a></li><li><a title="Dave&#39;s Users flip the switch!" rel="nofollow" href="https://pastebin.com/LKVFaUYp">Dave's Users flip the switch!</a></li><li><a title="Dave&#39;s War Story is really Screwy!" rel="nofollow" href="https://pastebin.com/tsfjKEhb">Dave's War Story is really Screwy!</a></li><li><a title="Egon&#39;s Adventures in misslabled VMs" rel="nofollow" href="https://pastebin.com/wg4y034g">Egon's Adventures in misslabled VMs</a></li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 357: The Return of Spectre</title>
  <link>https://techsnap.systems/357</link>
  <guid isPermaLink="false">3ad2e9bb-44f4-4889-8c42-992309c470df</guid>
  <pubDate>Thu, 22 Feb 2018 12:00:00 -0800</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/95197d05-40d6-4e68-8e0b-2f586ce8dc55/3ad2e9bb-44f4-4889-8c42-992309c470df.mp3" length="23510211" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>New variants, bad patches, busted microcode and devastated performance. It’s a TechSNAP  Meltdown and Spectre check up.</itunes:subtitle>
  <itunes:duration>31:53</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/9/95197d05-40d6-4e68-8e0b-2f586ce8dc55/cover.jpg?v=4"/>
  <description>New variants, bad patches, busted microcode and devastated performance. It’s a TechSNAP  Meltdown and Spectre check up.
Plus Tesla gets hit by Monero Cryptojacking, and a dating site that matches people based on their bad passwords…. So we gave it a go!
</description>
  <content:encoded>
    <![CDATA[<p>New variants, bad patches, busted microcode and devastated performance. It’s a TechSNAP  Meltdown and Spectre check up.</p>

<p>Plus Tesla gets hit by Monero Cryptojacking, and a dating site that matches people based on their bad passwords…. So we gave it a go!</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li></ul><p>Links:</p><ul><li><a title="People Are Actually Using a Joke Dating Site That Matches People Based on Their Passwords " rel="nofollow" href="https://motherboard.vice.com/en_us/article/wj4jyz/words-of-heart-password-joke-dating-website-">People Are Actually Using a Joke Dating Site That Matches People Based on Their Passwords </a> &mdash; This website answers the question no one ever asked: what if you dated someone who used the same password?</li><li><a title="Flight Sim Company Embeds Malware to Steal Pirates&#39; Passwords" rel="nofollow" href="https://torrentfreak.com/flight-sim-company-embeds-malware-to-steal-pirates-passwords-180219/">Flight Sim Company Embeds Malware to Steal Pirates' Passwords</a> &mdash; Flight sim company FlightSimLabs has found itself in trouble after installing malware onto users' machines as an anti-piracy measure. Code embedded in its A320-X module contained a mechanism for detecting 'pirate' serial numbers distributed on The Pirate Bay, which then triggered a process through which the company stole usernames and passwords from users' web browsers.</li><li><a title="Lessons from the Cryptojacking Attack at Tesla" rel="nofollow" href="https://blog.redlock.io/cryptojacking-tesla">Lessons from the Cryptojacking Attack at Tesla</a> &mdash; In cases involving the WannaMine malware, a tool called Mimikatz is used to pull credentials from a computer’s memory to infect other computers on the network. The malware then uses the infected computers’ compute to mine a cryptocurrency called Monero quietly in the background.</li><li><a title="Chef InSpec 2.0" rel="nofollow" href="https://techcrunch.com/2018/02/20/chef-inspec-2-0-wants-to-help-companies-automate-security-compliance-in-cloud-apps/">Chef InSpec 2.0</a> &mdash; InSpec is a free open source tool that enables development teams to express security and compliance rules as code. Version 1.0 was about ensuring that applications were set up properly. The new version extends this capability to the cloud where companies are running the applications, allowing teams to test and write rules for compliance with cloud security policy. It supports AWS and Azure and comes with 30 common configurations out of the box including Docker, IIS, NGINX and PostgreSQL.</li><li><a title="meltdownspectre-patches summary on Github" rel="nofollow" href="https://github.com/hannob/meltdownspectre-patches">meltdownspectre-patches summary on Github</a> &mdash; Summary of the patch status for Meltdown / Spectre.</li><li><a title="Spectre &amp; Meltdown Checker for Linux" rel="nofollow" href="https://github.com/speed47/spectre-meltdown-checker">Spectre &amp; Meltdown Checker for Linux</a> &mdash; A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.</li><li><a title="FreeBSD Finally Gets Mitigated For Spectre &amp; Meltdown" rel="nofollow" href="https://www.phoronix.com/scan.php?page=news_item&amp;px=FreeBSD-Spectre-Meltdown-Fix">FreeBSD Finally Gets Mitigated For Spectre &amp; Meltdown</a> &mdash; It's taken a few more weeks longer than most of the Linux distributions to be re-worked for Spectre/Meltdown mitigation as well as DragonFlyBSD, but with FreeBSD Revision 329462 it appears their initial fixes are in place. </li><li><a title="SpeculativeExecutionVulnerabilities - FreeBSD Wiki" rel="nofollow" href="https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities">SpeculativeExecutionVulnerabilities - FreeBSD Wiki</a></li><li><a title="Red Hat Checker" rel="nofollow" href="https://access.redhat.com/security/vulnerabilities/speculativeexecution">Red Hat Checker</a></li><li><a title="Debian Checker" rel="nofollow" href="https://packages.debian.org/stretch-backports/spectre-meltdown-checker?utm_source=dlvr.it&amp;utm_medium=twitter">Debian Checker</a></li><li><a title="Microsoft&#39;s free analytics service sniffs out Meltdown, Spectre patch status" rel="nofollow" href="https://www.computerworld.com/article/3254657/microsoft-windows/microsofts-free-analytics-service-sniffs-out-meltdown-spectre-patch-status.html">Microsoft's free analytics service sniffs out Meltdown, Spectre patch status</a> &mdash; Windows Analytics can now scan enterprise PCs running Windows 10, Windows 8.1 and Windows 7 and report on whether they're prepped to fend off attacks based on the Meltdown and Spectre vulnerabilities.</li><li><a title="KPTI/KAISER Meltdown Initial Performance Regressions" rel="nofollow" href="http://www.brendangregg.com/blog/2018-02-09/kpti-kaiser-meltdown-performance.html">KPTI/KAISER Meltdown Initial Performance Regressions</a> &mdash; In this post I'll look at the Linux kernel page table isolation (KPTI) patches that workaround Meltdown: what overheads to expect, and ways to tune them. Much of my testing was on Linux 4.14.11 and 4.14.12 a month ago, before we deployed in production. Some older kernels have the KAISER patches for Meltdown, and so far the performance overheads look similar. These results aren't final, since more changes are still being developed, such as for Spectre.</li><li><a title="New Spectre, Meltdown variants leave victims open to side-channel attacks" rel="nofollow" href="https://www.techrepublic.com/article/new-spectre-meltdown-variants-leave-victims-open-to-side-channel-attacks/">New Spectre, Meltdown variants leave victims open to side-channel attacks</a> &mdash; MeltdownPrime and SpectrePrime, found by Princeton and NVIDIA researchers, may require significant hardware changes to be mitigated. </li><li><a title="Question: How to Lock Down Firefox Addons" rel="nofollow" href="https://pastebin.com/6p82zt3g">Question: How to Lock Down Firefox Addons</a></li><li><a title="Locking preferences - MozillaZine Knowledge Base" rel="nofollow" href="http://kb.mozillazine.org/Locking_preferences">Locking preferences - MozillaZine Knowledge Base</a></li><li><a title="CCK2 Firefox Lockdown Tool" rel="nofollow" href="https://mike.kaply.com/cck2/">CCK2 Firefox Lockdown Tool</a></li><li><a title="Question: Namespaces and sandboxing" rel="nofollow" href="https://pastebin.com/ghMc0Nvi">Question: Namespaces and sandboxing</a></li><li><a title="Linux Sandboxing" rel="nofollow" href="https://chromium.googlesource.com/chromium/src/+/lkcr/docs/linux_sandboxing.md">Linux Sandboxing</a></li><li><a title="Firejail" rel="nofollow" href="https://firejail.wordpress.com/">Firejail</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>New variants, bad patches, busted microcode and devastated performance. It’s a TechSNAP  Meltdown and Spectre check up.</p>

<p>Plus Tesla gets hit by Monero Cryptojacking, and a dating site that matches people based on their bad passwords…. So we gave it a go!</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li></ul><p>Links:</p><ul><li><a title="People Are Actually Using a Joke Dating Site That Matches People Based on Their Passwords " rel="nofollow" href="https://motherboard.vice.com/en_us/article/wj4jyz/words-of-heart-password-joke-dating-website-">People Are Actually Using a Joke Dating Site That Matches People Based on Their Passwords </a> &mdash; This website answers the question no one ever asked: what if you dated someone who used the same password?</li><li><a title="Flight Sim Company Embeds Malware to Steal Pirates&#39; Passwords" rel="nofollow" href="https://torrentfreak.com/flight-sim-company-embeds-malware-to-steal-pirates-passwords-180219/">Flight Sim Company Embeds Malware to Steal Pirates' Passwords</a> &mdash; Flight sim company FlightSimLabs has found itself in trouble after installing malware onto users' machines as an anti-piracy measure. Code embedded in its A320-X module contained a mechanism for detecting 'pirate' serial numbers distributed on The Pirate Bay, which then triggered a process through which the company stole usernames and passwords from users' web browsers.</li><li><a title="Lessons from the Cryptojacking Attack at Tesla" rel="nofollow" href="https://blog.redlock.io/cryptojacking-tesla">Lessons from the Cryptojacking Attack at Tesla</a> &mdash; In cases involving the WannaMine malware, a tool called Mimikatz is used to pull credentials from a computer’s memory to infect other computers on the network. The malware then uses the infected computers’ compute to mine a cryptocurrency called Monero quietly in the background.</li><li><a title="Chef InSpec 2.0" rel="nofollow" href="https://techcrunch.com/2018/02/20/chef-inspec-2-0-wants-to-help-companies-automate-security-compliance-in-cloud-apps/">Chef InSpec 2.0</a> &mdash; InSpec is a free open source tool that enables development teams to express security and compliance rules as code. Version 1.0 was about ensuring that applications were set up properly. The new version extends this capability to the cloud where companies are running the applications, allowing teams to test and write rules for compliance with cloud security policy. It supports AWS and Azure and comes with 30 common configurations out of the box including Docker, IIS, NGINX and PostgreSQL.</li><li><a title="meltdownspectre-patches summary on Github" rel="nofollow" href="https://github.com/hannob/meltdownspectre-patches">meltdownspectre-patches summary on Github</a> &mdash; Summary of the patch status for Meltdown / Spectre.</li><li><a title="Spectre &amp; Meltdown Checker for Linux" rel="nofollow" href="https://github.com/speed47/spectre-meltdown-checker">Spectre &amp; Meltdown Checker for Linux</a> &mdash; A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.</li><li><a title="FreeBSD Finally Gets Mitigated For Spectre &amp; Meltdown" rel="nofollow" href="https://www.phoronix.com/scan.php?page=news_item&amp;px=FreeBSD-Spectre-Meltdown-Fix">FreeBSD Finally Gets Mitigated For Spectre &amp; Meltdown</a> &mdash; It's taken a few more weeks longer than most of the Linux distributions to be re-worked for Spectre/Meltdown mitigation as well as DragonFlyBSD, but with FreeBSD Revision 329462 it appears their initial fixes are in place. </li><li><a title="SpeculativeExecutionVulnerabilities - FreeBSD Wiki" rel="nofollow" href="https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities">SpeculativeExecutionVulnerabilities - FreeBSD Wiki</a></li><li><a title="Red Hat Checker" rel="nofollow" href="https://access.redhat.com/security/vulnerabilities/speculativeexecution">Red Hat Checker</a></li><li><a title="Debian Checker" rel="nofollow" href="https://packages.debian.org/stretch-backports/spectre-meltdown-checker?utm_source=dlvr.it&amp;utm_medium=twitter">Debian Checker</a></li><li><a title="Microsoft&#39;s free analytics service sniffs out Meltdown, Spectre patch status" rel="nofollow" href="https://www.computerworld.com/article/3254657/microsoft-windows/microsofts-free-analytics-service-sniffs-out-meltdown-spectre-patch-status.html">Microsoft's free analytics service sniffs out Meltdown, Spectre patch status</a> &mdash; Windows Analytics can now scan enterprise PCs running Windows 10, Windows 8.1 and Windows 7 and report on whether they're prepped to fend off attacks based on the Meltdown and Spectre vulnerabilities.</li><li><a title="KPTI/KAISER Meltdown Initial Performance Regressions" rel="nofollow" href="http://www.brendangregg.com/blog/2018-02-09/kpti-kaiser-meltdown-performance.html">KPTI/KAISER Meltdown Initial Performance Regressions</a> &mdash; In this post I'll look at the Linux kernel page table isolation (KPTI) patches that workaround Meltdown: what overheads to expect, and ways to tune them. Much of my testing was on Linux 4.14.11 and 4.14.12 a month ago, before we deployed in production. Some older kernels have the KAISER patches for Meltdown, and so far the performance overheads look similar. These results aren't final, since more changes are still being developed, such as for Spectre.</li><li><a title="New Spectre, Meltdown variants leave victims open to side-channel attacks" rel="nofollow" href="https://www.techrepublic.com/article/new-spectre-meltdown-variants-leave-victims-open-to-side-channel-attacks/">New Spectre, Meltdown variants leave victims open to side-channel attacks</a> &mdash; MeltdownPrime and SpectrePrime, found by Princeton and NVIDIA researchers, may require significant hardware changes to be mitigated. </li><li><a title="Question: How to Lock Down Firefox Addons" rel="nofollow" href="https://pastebin.com/6p82zt3g">Question: How to Lock Down Firefox Addons</a></li><li><a title="Locking preferences - MozillaZine Knowledge Base" rel="nofollow" href="http://kb.mozillazine.org/Locking_preferences">Locking preferences - MozillaZine Knowledge Base</a></li><li><a title="CCK2 Firefox Lockdown Tool" rel="nofollow" href="https://mike.kaply.com/cck2/">CCK2 Firefox Lockdown Tool</a></li><li><a title="Question: Namespaces and sandboxing" rel="nofollow" href="https://pastebin.com/ghMc0Nvi">Question: Namespaces and sandboxing</a></li><li><a title="Linux Sandboxing" rel="nofollow" href="https://chromium.googlesource.com/chromium/src/+/lkcr/docs/linux_sandboxing.md">Linux Sandboxing</a></li><li><a title="Firejail" rel="nofollow" href="https://firejail.wordpress.com/">Firejail</a></li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>Episode 351: Performance Meltdown</title>
  <link>https://techsnap.systems/351</link>
  <guid isPermaLink="false">92c20700-9d53-4470-a263-d3e009a19100</guid>
  <pubDate>Thu, 11 Jan 2018 16:00:00 -0800</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/95197d05-40d6-4e68-8e0b-2f586ce8dc55/92c20700-9d53-4470-a263-d3e009a19100.mp3" length="30893583" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>The types of workloads that will see the largest performance impacts from Meltdown, tools to test yourself, and the outlook for 2018.

Plus a concise breakdown of Meltdown, Spectre, and side-channel attacks like only TechSNAP can. </itunes:subtitle>
  <itunes:duration>41:43</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://media24.fireside.fm/file/fireside-images-2024/podcasts/images/9/95197d05-40d6-4e68-8e0b-2f586ce8dc55/cover.jpg?v=4"/>
  <description>The types of workloads that will see the largest performance impacts from Meltdown, tools to test yourself, and the outlook for 2018.
Plus a concise breakdown of Meltdown, Spectre, and side-channel attacks like only TechSNAP can. 
Then we run through the timeline of events, and the scuttlebutt of so called coordinated disclosure. We also discuss yet another security issue in macOS High Sierra, a backdoor in popular storage appliances, your questions, and more! 
</description>
  <content:encoded>
    <![CDATA[<p>The types of workloads that will see the largest performance impacts from Meltdown, tools to test yourself, and the outlook for 2018.</p>

<p>Plus a concise breakdown of Meltdown, Spectre, and side-channel attacks like only TechSNAP can. </p>

<p>Then we run through the timeline of events, and the scuttlebutt of so called coordinated disclosure. We also discuss yet another security issue in macOS High Sierra, a backdoor in popular storage appliances, your questions, and more!</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li></ul><p>Links:</p><ul><li><a title="Meltdown and Spectre" rel="nofollow" href="https://meltdownattack.com/">Meltdown and Spectre</a> &mdash; Meltdown and Spectre exploit critical vulnerabilities in modern processors. </li><li><a title="The Meltdown and Spectre CPU Bugs, Explained" rel="nofollow" href="https://blog.barkly.com/meltdown-spectre-bugs-explained">The Meltdown and Spectre CPU Bugs, Explained</a></li><li><a title="How we got to Spectre and Meltdown A Timeline My version of the timeline..." rel="nofollow" href="https://plus.google.com/+jwildeboer/posts/jj6a9JUaovP">How we got to Spectre and Meltdown A Timeline My version of the timeline...</a> &mdash; My version of the timeline on Spectre Meltdown. This post will be updated! If you want to add/correct something, please comment.</li><li><a title="How Tier 2 cloud vendors banded together to cope with Spectre and Meltdown | TechCrunch" rel="nofollow" href="https://techcrunch.com/2018/01/06/how-tier-2-cloud-vendors-banded-together-to-cope-with-spectre-and-meltdown/">How Tier 2 cloud vendors banded together to cope with Spectre and Meltdown | TechCrunch</a> &mdash; Eventually six cloud providers — Scaleway, DigitalOcean, Packet, Vultr, Linode and OVH — formed a consortium of sorts to help one another and share information. In order to make the process more efficient, they started a Slack channel with CEOs, CTOs and engineers from the various companies sharing information and fixes as they became available.</li><li><a title="FreeBSD was made aware of Meltdown and Spectre in late December. There&#39;s currently no ETA for mitigation." rel="nofollow" href="https://www.reddit.com/r/freebsd/comments/7och5a/freebsd_was_made_aware_of_meltdown_and_spectre_in/">FreeBSD was made aware of Meltdown and Spectre in late December. There's currently no ETA for mitigation.</a> &mdash; It looks like Dragonfly BSD has a patch, so hopefully that will be useful for FreeBSD.</li><li><a title="heads up: Fix for intel hardware bug will lead to performance regressions" rel="nofollow" href="https://www.postgresql.org/message-id/20180102222354.qikjmf7dvnjgbkxe@alap3.anarazel.de">heads up: Fix for intel hardware bug will lead to performance regressions</a> &mdash; Upcoming versions of the linux kernel (and apparently also windows and
others), will include new feature that apparently has been implemented
with haste to work around an intel hardware bug.</li><li><a title="AWS Developer Forums: Degraded performance" rel="nofollow" href="https://forums.aws.amazon.com/thread.jspa?threadID=269858">AWS Developer Forums: Degraded performance</a> &mdash; Immediately following the reboot my server running on this instance started to suffer from cpu stress.</li><li><a title="Google is pushing Retpoline" rel="nofollow" href="https://www.blog.google/topics/google-cloud/protecting-our-google-cloud-customers-new-vulnerabilities-without-impacting-performance/">Google is pushing Retpoline</a> &mdash; With Retpoline, we could protect our infrastructure at compile-time, with no source-code modifications. Furthermore, testing this feature, particularly when combined with optimizations such as software branch prediction hints, demonstrated that this protection came with almost no performance loss.

</li><li><a title="PCID is now a critical performance/security feature on x86 " rel="nofollow" href="http://archive.is/ma8Iw#selection-341.2-344.0">PCID is now a critical performance/security feature on x86 </a> &mdash; On any system that does not currently show "pcid" in the flags line of /proc/cpuinfo, Meltdown is a bigger issue than "install latest updates".
</li><li><a title="Spectre &amp; Meltdown vulnerability/mitigation checker for Linux" rel="nofollow" href="https://github.com/speed47/spectre-meltdown-checker">Spectre &amp; Meltdown vulnerability/mitigation checker for Linux</a> &mdash; A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.</li><li><a title="Microsoft PowerShell Script to check for Meltdown" rel="nofollow" href="https://support.microsoft.com/en-gb/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in">Microsoft PowerShell Script to check for Meltdown</a> &mdash; To help customers verify that protections are enabled, Microsoft has published a PowerShell script that customers can run on their systems. Install and run the script by running the following commands.

</li><li><a title="Why Raspberry Pi isn&#39;t vulnerable to Spectre or Meltdown" rel="nofollow" href="https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/">Why Raspberry Pi isn't vulnerable to Spectre or Meltdown</a> &mdash; To help us understand why, here’s a little primer on some concepts in modern processor design. </li><li><a title="macOS High Sierra&#39;s App Store System Preferences Can Be Unlocked With Any Password" rel="nofollow" href="https://www.macrumors.com/2018/01/10/macos-high-sierra-app-store-password-bug/">macOS High Sierra's App Store System Preferences Can Be Unlocked With Any Password</a> &mdash; A bug report submitted on Open Radar this week has revealed a security flaw in the current version of macOS High Sierra that allows the App Store menu in System Preferences to be unlocked with any password. </li><li><a title="Major macOS High Sierra Bug Allows Full Admin Access Without Password" rel="nofollow" href="https://www.macrumors.com/2017/11/28/macos-high-sierra-bug-admin-access/">Major macOS High Sierra Bug Allows Full Admin Access Without Password</a></li><li><a title="WD My Cloud NAS devices have hard-wired backdoor" rel="nofollow" href="https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_backdoor/">WD My Cloud NAS devices have hard-wired backdoor</a> &mdash; Lets anyone log in as user mydlinkBRionyg with the password abc12345cba.</li><li><a title="Question: How could I measure all of these overhead performance hits?" rel="nofollow" href="https://slexy.org/view/s2hNxl4Ras">Question: How could I measure all of these overhead performance hits?</a> &mdash; My question: how could I measure all of these overhead performance hits, so I can put in a well educated request to adjust all of these components, so I have a computer that performs near its capacity?</li><li><a title="Perfmon" rel="nofollow" href="https://technet.microsoft.com/en-us/library/bb490957.aspx">Perfmon</a></li><li><a title="Troubleshooting with the Windows Sysinternals Tools" rel="nofollow" href="https://docs.microsoft.com/en-us/sysinternals/learn/troubleshooting-book">Troubleshooting with the Windows Sysinternals Tools</a></li><li><a title="ProcDump" rel="nofollow" href="https://docs.microsoft.com/en-us/sysinternals/downloads/procdump">ProcDump</a></li><li><a title="Process Monitor - Replaces filemon" rel="nofollow" href="https://docs.microsoft.com/en-us/sysinternals/downloads/procmon">Process Monitor - Replaces filemon</a></li><li><a title="Question: MySQL Replication Woes" rel="nofollow" href="https://slexy.org/view/s2iRKPgsGI">Question: MySQL Replication Woes</a> &mdash; The problem is that during some larger deletes on the master, the tables on the slave get locked and the slave lag goes through the roof.. During this time all of my selects that have been sent to the slave are just sitting there and waiting for the table to unlock while the master is just fine.</li><li><a title="Ask Noah 44: Red Hat with Brandon Johnson" rel="nofollow" href="http://www.jupiterbroadcasting.com/121292/redhat-with-brandon-johnson-ask-noah-44/">Ask Noah 44: Red Hat with Brandon Johnson</a></li><li><a title="BSD Now 228: The Spectre of Meltdown" rel="nofollow" href="http://www.jupiterbroadcasting.com/121362/the-spectre-of-meltdown-bsd-now-228/">BSD Now 228: The Spectre of Meltdown</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>The types of workloads that will see the largest performance impacts from Meltdown, tools to test yourself, and the outlook for 2018.</p>

<p>Plus a concise breakdown of Meltdown, Spectre, and side-channel attacks like only TechSNAP can. </p>

<p>Then we run through the timeline of events, and the scuttlebutt of so called coordinated disclosure. We also discuss yet another security issue in macOS High Sierra, a backdoor in popular storage appliances, your questions, and more!</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li><li><a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li><li><a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li></ul><p>Links:</p><ul><li><a title="Meltdown and Spectre" rel="nofollow" href="https://meltdownattack.com/">Meltdown and Spectre</a> &mdash; Meltdown and Spectre exploit critical vulnerabilities in modern processors. </li><li><a title="The Meltdown and Spectre CPU Bugs, Explained" rel="nofollow" href="https://blog.barkly.com/meltdown-spectre-bugs-explained">The Meltdown and Spectre CPU Bugs, Explained</a></li><li><a title="How we got to Spectre and Meltdown A Timeline My version of the timeline..." rel="nofollow" href="https://plus.google.com/+jwildeboer/posts/jj6a9JUaovP">How we got to Spectre and Meltdown A Timeline My version of the timeline...</a> &mdash; My version of the timeline on Spectre Meltdown. This post will be updated! If you want to add/correct something, please comment.</li><li><a title="How Tier 2 cloud vendors banded together to cope with Spectre and Meltdown | TechCrunch" rel="nofollow" href="https://techcrunch.com/2018/01/06/how-tier-2-cloud-vendors-banded-together-to-cope-with-spectre-and-meltdown/">How Tier 2 cloud vendors banded together to cope with Spectre and Meltdown | TechCrunch</a> &mdash; Eventually six cloud providers — Scaleway, DigitalOcean, Packet, Vultr, Linode and OVH — formed a consortium of sorts to help one another and share information. In order to make the process more efficient, they started a Slack channel with CEOs, CTOs and engineers from the various companies sharing information and fixes as they became available.</li><li><a title="FreeBSD was made aware of Meltdown and Spectre in late December. There&#39;s currently no ETA for mitigation." rel="nofollow" href="https://www.reddit.com/r/freebsd/comments/7och5a/freebsd_was_made_aware_of_meltdown_and_spectre_in/">FreeBSD was made aware of Meltdown and Spectre in late December. There's currently no ETA for mitigation.</a> &mdash; It looks like Dragonfly BSD has a patch, so hopefully that will be useful for FreeBSD.</li><li><a title="heads up: Fix for intel hardware bug will lead to performance regressions" rel="nofollow" href="https://www.postgresql.org/message-id/20180102222354.qikjmf7dvnjgbkxe@alap3.anarazel.de">heads up: Fix for intel hardware bug will lead to performance regressions</a> &mdash; Upcoming versions of the linux kernel (and apparently also windows and
others), will include new feature that apparently has been implemented
with haste to work around an intel hardware bug.</li><li><a title="AWS Developer Forums: Degraded performance" rel="nofollow" href="https://forums.aws.amazon.com/thread.jspa?threadID=269858">AWS Developer Forums: Degraded performance</a> &mdash; Immediately following the reboot my server running on this instance started to suffer from cpu stress.</li><li><a title="Google is pushing Retpoline" rel="nofollow" href="https://www.blog.google/topics/google-cloud/protecting-our-google-cloud-customers-new-vulnerabilities-without-impacting-performance/">Google is pushing Retpoline</a> &mdash; With Retpoline, we could protect our infrastructure at compile-time, with no source-code modifications. Furthermore, testing this feature, particularly when combined with optimizations such as software branch prediction hints, demonstrated that this protection came with almost no performance loss.

</li><li><a title="PCID is now a critical performance/security feature on x86 " rel="nofollow" href="http://archive.is/ma8Iw#selection-341.2-344.0">PCID is now a critical performance/security feature on x86 </a> &mdash; On any system that does not currently show "pcid" in the flags line of /proc/cpuinfo, Meltdown is a bigger issue than "install latest updates".
</li><li><a title="Spectre &amp; Meltdown vulnerability/mitigation checker for Linux" rel="nofollow" href="https://github.com/speed47/spectre-meltdown-checker">Spectre &amp; Meltdown vulnerability/mitigation checker for Linux</a> &mdash; A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.</li><li><a title="Microsoft PowerShell Script to check for Meltdown" rel="nofollow" href="https://support.microsoft.com/en-gb/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in">Microsoft PowerShell Script to check for Meltdown</a> &mdash; To help customers verify that protections are enabled, Microsoft has published a PowerShell script that customers can run on their systems. Install and run the script by running the following commands.

</li><li><a title="Why Raspberry Pi isn&#39;t vulnerable to Spectre or Meltdown" rel="nofollow" href="https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/">Why Raspberry Pi isn't vulnerable to Spectre or Meltdown</a> &mdash; To help us understand why, here’s a little primer on some concepts in modern processor design. </li><li><a title="macOS High Sierra&#39;s App Store System Preferences Can Be Unlocked With Any Password" rel="nofollow" href="https://www.macrumors.com/2018/01/10/macos-high-sierra-app-store-password-bug/">macOS High Sierra's App Store System Preferences Can Be Unlocked With Any Password</a> &mdash; A bug report submitted on Open Radar this week has revealed a security flaw in the current version of macOS High Sierra that allows the App Store menu in System Preferences to be unlocked with any password. </li><li><a title="Major macOS High Sierra Bug Allows Full Admin Access Without Password" rel="nofollow" href="https://www.macrumors.com/2017/11/28/macos-high-sierra-bug-admin-access/">Major macOS High Sierra Bug Allows Full Admin Access Without Password</a></li><li><a title="WD My Cloud NAS devices have hard-wired backdoor" rel="nofollow" href="https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_backdoor/">WD My Cloud NAS devices have hard-wired backdoor</a> &mdash; Lets anyone log in as user mydlinkBRionyg with the password abc12345cba.</li><li><a title="Question: How could I measure all of these overhead performance hits?" rel="nofollow" href="https://slexy.org/view/s2hNxl4Ras">Question: How could I measure all of these overhead performance hits?</a> &mdash; My question: how could I measure all of these overhead performance hits, so I can put in a well educated request to adjust all of these components, so I have a computer that performs near its capacity?</li><li><a title="Perfmon" rel="nofollow" href="https://technet.microsoft.com/en-us/library/bb490957.aspx">Perfmon</a></li><li><a title="Troubleshooting with the Windows Sysinternals Tools" rel="nofollow" href="https://docs.microsoft.com/en-us/sysinternals/learn/troubleshooting-book">Troubleshooting with the Windows Sysinternals Tools</a></li><li><a title="ProcDump" rel="nofollow" href="https://docs.microsoft.com/en-us/sysinternals/downloads/procdump">ProcDump</a></li><li><a title="Process Monitor - Replaces filemon" rel="nofollow" href="https://docs.microsoft.com/en-us/sysinternals/downloads/procmon">Process Monitor - Replaces filemon</a></li><li><a title="Question: MySQL Replication Woes" rel="nofollow" href="https://slexy.org/view/s2iRKPgsGI">Question: MySQL Replication Woes</a> &mdash; The problem is that during some larger deletes on the master, the tables on the slave get locked and the slave lag goes through the roof.. During this time all of my selects that have been sent to the slave are just sitting there and waiting for the table to unlock while the master is just fine.</li><li><a title="Ask Noah 44: Red Hat with Brandon Johnson" rel="nofollow" href="http://www.jupiterbroadcasting.com/121292/redhat-with-brandon-johnson-ask-noah-44/">Ask Noah 44: Red Hat with Brandon Johnson</a></li><li><a title="BSD Now 228: The Spectre of Meltdown" rel="nofollow" href="http://www.jupiterbroadcasting.com/121362/the-spectre-of-meltdown-bsd-now-228/">BSD Now 228: The Spectre of Meltdown</a></li></ul>]]>
  </itunes:summary>
</item>
  </channel>
</rss>
