The Insider News

Google V8 Development blog

Software mitigations are an unsustainable path

Fortunately or unfortunately, our offensive research advanced much faster than our defensive research, and we quickly discovered that software mitigation of all possible leaks due to Spectre was infeasible. This was due to a variety of reasons. First, the engineering effort diverted to combating Spectre was disproportionate to its threat level. In V8 we face many other security threats that are much worse, from direct out-of-bound reads due to regular bugs (faster and more direct than Spectre), out-of-bound writes (impossible with Spectre, and worse) and potential remote code execution (impossible with Spectre and much, much worse). Second, the increasingly complicated mitigations that we designed and implemented carried significant complexity, which is technical debt and might actually increase the attack surface, and performance overheads. Third, testing and maintaining mitigations for microarchitectural leaks is even trickier than designing gadgets themselves, since it’s hard to be sure the mitigations continue working as designed. At least once, important mitigations were effectively undone by later compiler optimizations. Fourth, we found that effective mitigation of some variants of Spectre, particularly variant 4, to be simply infeasible in software, even after a heroic effort by our partners at Apple to combat the problem in their JIT compiler.

Engadget

As the blog post explains, if a password is never stolen, there's no need to expire it. And if a password is suspected to be stolen, you would want to act immediately, not wait until the expiration date. Forced updates also lead to more users writing their passwords down or forgetting them altogether. Plus, as Microsoft puts it, "if your users are the kind who are willing to answer surveys in the parking lot that exchange a candy bar for their passwords, no password expiration policy will help you."

Eurogamer[^]:

Last week, after seven years of work, Nintendo fan ZeroPaige finally released a working port of Super Mario Bros. for the Commodore 64.

BetaNews[^]:

Windows 7 users have started to report the appearance of a pop-up message from Microsoft informing them that support for the operating system is coming to an end.

Ars Technica[^]:

For two periods last year, those using preview builds of Windows 10 could access a feature called Sets: a tabbed interface that was eventually to allow tabs to be put in the titlebar of just about any window.

Ars Technica[^]:

There's a set of H-series processors for laptops and a complete range of desktop processors across the Celeron, Pentium, and Core brands, from i3 all the way to i9.