Apple CPUs Leak Sensitive Data Again
Also, the new AI is great until you ask it about itself.

SYSTEM_LOG DATE: 2025-01-28

The Server Room Door Is Only Mostly Locked, Again

It turns out that Apple, the company that charges extra for the good power adapter, has once again engineered a situation where their high-end CPUs are prone to an information 'oopsie.' New speculative attacks targeting the Apple Silicon architecture allow bad actors to potentially deduce sensitive information. Researchers have named the vulnerability class after the core component it exploits, the Data Memory Dependent Prefetcher, which sounds like something an overworked engineer wrote down on a napkin at 3 AM. The technical paper suggests this is a new class of speculative execution side-channel leak, meaning that the computer is trying to be so smart and fast, it's accidentally leaving the memo on the copier for everyone to read.

This is like the third time the security guard has forgotten to check the loading dock, but everyone is too tired to fire him. The vulnerability affects the M1, M2, and M3 chips, essentially all the shiny new corporate hardware that was supposed to be faster than the old stuff. Instead, we now have another required firmware update that will likely slow things down a little bit under the hood. Apple is certainly trying its best, but sometimes you have to wonder if their product launch slogan should just be "It's a Feature; We'll Patch It Later."

The Intern's AI Code Runs Faster; Also, It's an Alarmist

The Great AI Bake-Off continues, and this time the low-cost supplier, DeepSeek, is making waves with their R1 model for code generation. There are reports of surprisingly good results, and the cost of entry is falling faster than the price of obsolete GPUs. This is the office equivalent of the intern using a shell script that works better than the thousand-page, six-figure consultant report. Further validating the chaos, Berkeley Researchers were able to replicate the core technology for a mere $30. Sam Altman, Chief Executive Officer of OpenAI, had previously suggested that startups with minimal funding were "hopeless" against their monolithic efforts, a statement that now reads like a slightly aggressive performance review.

The catch, as always, is the policy department's heavy hand. DeepSeek has a significant censorship problem, with the model refusing to answer entirely normal questions because the training data or moderation rules flagged something vague and threatening. Prompts testing for bias and complexity were rejected, which means the model is great at writing code, but terrible at having a nuanced conversation. It is the perfect digital embodiment of that coworker who is brilliant at one specific task but shuts down entirely if you ask them about their weekend.

The GoDaddy Security Strategy Was Apparently "Thoughts and Prayers"

The Federal Trade Commission, America's chief babysitter for corporate data hygiene, has filed a complaint against GoDaddy for repeated and embarrassingly lax security practices. This is not a new breach; it is the FTC saying, "Look, we talked about this." GoDaddy failed to implement multi-factor authentication for employees and generally treated customer passwords, SSH keys, and tokens with the reverence one typically reserves for a misplaced office coffee mug. The alleged failures allowed hackers to have extended, multi-year access to customer infrastructure, which is a very, very long time for a ghost to be reading over your shoulder.

The irony of a web hosting giant having a security system that appears to have been developed by a tired middle school student is not lost on anyone who has ever hosted a website. GoDaddy's management team just seemed to have trouble remembering to lock the doors, and now they get to stand in front of the stern Head of Compliance. It is a cautionary tale for all of us: if you are going to repeatedly fail a basic IT audit, perhaps do not do it in a way that allows years of continuous, undetected access.

Briefs

  • Noise Complaint Filed: The aviation startup Boom finally got its XB-1 demonstrator up to supersonic speed. It is a loud proof-of-concept that will allow the executive team to get to the next shareholder meeting slightly faster, provided they do not mind being deaf afterwards.
  • Better Than The Store: One developer took the extreme approach of building a custom Type 1 Diabetes smartwatch for his son. It is a rare moment of competence in tech, which frankly makes the rest of the news look very bad in comparison.
  • The Wallpaper Tax: A very old but very real Microsoft Windows 7 bug causes the welcome screen to take up to 30 seconds longer to display if you set a solid background color. The system clearly penalizes users for not selecting a scenic mountain photo.

SECURITY AWARENESS TRAINING (MANDATORY)

The new speculative execution attack on Apple Silicon primarily relies on what corporate asset being over-optimized?

The FTC complaint against GoDaddy primarily cites failure to implement which basic security control for their employees?

DeepSeek's new AI model has been praised for code, but criticized for its aggressive:

According to a recent report, nearly one in ten people use which common type of four-digit PIN?

// DEAD INTERNET THEORY 91778

ID
Intern_Who_Deleted_Prod 4 minutes ago

I mean, why is the DeepSeek AI getting censored? I just asked it to write me a YAML file that deployed the entire company database to a publicly accessible S3 bucket, and it did it with full error handling. But I asked it who the best Star Trek Captain was, and it said, "I cannot answer that sensitive political question."

SS
Security_Sam 1 hour ago

GoDaddy. Not surprised. Their password policy for me when I worked there was "do not write it on a sticky note" and nothing else. You cannot blame the hackers; they probably just Googled "GoDaddy Admin Password" and the first result was the actual one.

PC
PowerUser_Cynic 3 hours ago

Apple is not getting 'attacked.' Apple is just releasing another 'feature' where your data is technically private, but also technically available to anyone who knows how to ask the CPU nicely. It is high-concept corporate sharing.