Hi, I'm the guy who wrote the original VCBlog post. I would assert that we've been consistent in our messaging: there is not an automatic fix available for Spectre. The /Qspectre switch offers help in mitigation. It doesn't offer, nor does it claim to offer, complete protection.
We--as an industry--are learning as we go with Spectre. There's a lot of data that went into the decision to release this switch with its current implementation. And this isn't the last iteration: note in Paul Kocher's writeup that we've asked for feedback as to whether anyone would use a switch that was sound (for known variants) but incurred very large performance regressions.
As evidence that this is an industry-wide issue, I ask that you reread Paul Kocher's post. Also, see Chandler Carruth's tweet this morning about this topic: https://twitter.com/chandlerc1024/status/963995521705627648. Chandler is the guy driving Spectre in LLVM.
Lastly, understand that Microsoft has a lot of customers who rely on our technologies. For their benefit it's often better to say less than to say more, especially when talking about security vulnerabilities.
"Managed memory is free. Not as in free beer, as in free puppy."
Dev manager of Exchange used that line in a talk. Never were more insightful words spoken. Devs will move from C++ where they obsess about every allocation to .NET and they'll totally forget that allocation is expensive no matter what the platform or runtime.
Having worked for 7 years on the .NET runtime team, I can attest that the BOTR is the official reference. It was created as documentation for the engineering team, by the engineering team. And it was (supposed to be) kept up to date any time a new feature was added or changed.
Coercion is a concern in communities where there's a power imbalance in the home. Consider, for example, an overbearing husband coercing his wife to vote in a particular manner, or just taking her ballot and voting it himself (and coercing her to sign the back of the envelope.)
An option considered in one state (Utah?) was to allow mail-in voting, but the mailed ballot could be invalidated if you stopped into a polling place and voted. It adds some complexity but reduces the absolute chance of coercion.
Windows 10 has two update channels. Under "Windows Update" > "Advanced Options" there are two separate settings to delay "feature updates" and "quality updates".
I don't know whether earlier versions of Windows offer this level of control as I've got Win10 on all my machines. I just leave them on automatic update and yet I still only have two ears.
Great feedback, thank you! Linux targeting isn't my area, but I know the guy who owns it would love to chat with you. If you want to help us make this better, would you mind sending me an email at apardoe @ youknowthecompany.com? I totally understand if it's not worth your time. But thank you regardless!
Sure, I can accept that a platform can be doing more than a website and also that you have less control over a platform. Good points, both.
I won't comment on Android. I already got ripped to shreds above by trying to bring up the point that mobile is completely locked into two major players that act exactly like Windows 10.
Wow, sorry. No, no, I'm not triggered at all. I was only trying to illustrate the fact that there are times when we have no choice but to use an OS that uses telemetry.
I'll happily concede this thread and apologize for having brought it up. I really wasn't trying to start a fight. I was trying to give what I thought was an analogous example.
I didn't mean to offend. I'm just saying that if you think paying for an OS means you won't have data collection, then you're unlikely to find a smartphone that suits you.
My point, exactly, is that Microsoft is just another tech company these days. They're not the Evil Empire. At best, they are one of Many Evil Fiefdoms.
I understand that people are up in arms about data collection. And I understand that Microsoft tends to bungle any kind of public messaging about data collection. I'm just pointing out that every mobile OS, at least, collects tons of data.
Thanks for the downvotes! But seriously, do you honestly think that Microsoft is spying on your more than Google, Facebook, or Amazon? And do you think your Mac OS doesn't have the exact same sort of telemetry (or more!) that Windows has?
I know someone who works at Microsoft (and has for 15 years.) These cartoons are brilliant--especially the org charts for different companies--but things actually are changing at Microsoft.
Some divisions change faster than others. And some old reputations are very hard to shake. But Microsoft isn't the company it used to be. There are other companies filling that role now. Example: Even though all you ever hear about is "Windows is spying on me!" I can name three big tech companies that probably know more about you than Microsoft does.
I can either be charitable or accusatory :) It's not so obscure as to how one might run Xcode tools on another Unix-like OS. It's just illegal. Apple tightly controls their entire stack.
I don't think you'll find a way to seamlessly build native iOS apps from Windows. Visual Studio has a great development environment for iOS apps but the compilation still has to happen on a Mac. It's more difficult for developers, but Apple tightly controls their entire stack.
And for all of you on the thread who say Windows is a disaster for developers, I'd love to chat with you. I'm the guy for the MSVC C++ front end and code analysis. Either PM me or mail me: my work address is apardoe at youknowthecompany.com
Bruce, thanks for the kick! Six years is a long time to wait for a bug resolution.
It turns out that our compiler has a minimum size limit in a memset optimization. I’m sure the size limit was there for a Very Good Reason (TM) at one point in time, but we are investigating whether we can remove it. Step one is understanding why it was there in the first place.
We--as an industry--are learning as we go with Spectre. There's a lot of data that went into the decision to release this switch with its current implementation. And this isn't the last iteration: note in Paul Kocher's writeup that we've asked for feedback as to whether anyone would use a switch that was sound (for known variants) but incurred very large performance regressions.
As evidence that this is an industry-wide issue, I ask that you reread Paul Kocher's post. Also, see Chandler Carruth's tweet this morning about this topic: https://twitter.com/chandlerc1024/status/963995521705627648. Chandler is the guy driving Spectre in LLVM.
Lastly, understand that Microsoft has a lot of customers who rely on our technologies. For their benefit it's often better to say less than to say more, especially when talking about security vulnerabilities.