It's a bad time to be a JavaScript developer, after Koi Security revealed yesterday that it is tracking "the largest and most dangerous npm supply-chain compromise in history."

The security firm said the Shai-Hulud malware campaign "has now impacted hundreds of packages across multiple maintainers," including "popular libraries such as @ctrl/tinycolor as well as packages maintained by CrowdStrike." (Emphasis theirs.) And the problem is probably going to get worse before it gets better, because the malware in question is a worm that autonomously spreads from package to package.

"Attackers published malicious versions of @ctrl/tinycolor and other npm packages, injecting a large obfuscated script (bundle.js) that executes automatically during installation," Koi Security said in the blog post revealing this campaign. "This payload repackages and republishes maintainer projects, enabling the malware to spread laterally across related packages without direct developer involvement."

To be clear: This campaign is distinct from the incident that we covered on Sept. 9, which saw multiple npm packages with billions of weekly downloads compromised in a bid to steal cryptocurrency. The ecosystem is the same — attackers have clearly realized the GitHub-owned npm package registry for the Node.js ecosystem is a valuable target—but whoever's behind the Shai-Hulud campaign is after more than just some Bitcoin.

"The injected script performs credential harvesting and persistence operations," Koi Security said. "It runs TruffleHog to scan local filesystems and repositories for secrets, including npm tokens, GitHub credentials, and cloud access keys for [Amazon Web Services], [Google Cloud Platform], and Azure. It also writes a hidden GitHub Actions workflow file (.github/workflows/shai-hulud-workflow.yml) that exfiltrates secrets during CI/CD runs, ensuring long-term access even after the initial infection. This dual focus on endpoint secret theft and backdoors makes Shai-Hulud one of the most dangerous campaigns ever compared to previous compromises."

That might be confusing to anyone who doesn't have to worry about developing and distributing Node.js software. But the long and short of it is that Shai-Hulud is using a well-known offensive security tool (TruffleHog) alongside developer tooling (GitHub Actions) in an environment that is designed specifically to help distribute software without much developer involvement (npm).

We suggested in our previous report that whoever compromised the npm packages to steal cryptocurrency did us a favor, because they could have used their access to those packages to accomplish far worse attacks. Now it seems that someone is looking to do just that — and it's hard to feign surprise when the Node.js ecosystem and the tooling built around it were practically built to enable widespread attacks like this.

Koi Security is updating its blog post with a list of npm packages known to have been compromised via the Shai-Hulud campaign. StepSecurity has also published indicators of compromise alongside a technical breakdown of how the malware spreads, what it does, and how organizations should respond if they discover that a compromised package has been used somewhere in their infrastructure.

A total of 18 JavaScript packages that have over 2 billion weekly downloads have been injected with malicious code in what is billed as the largest supply chain hack in history. The compromised code was designed to steal cryptocurrency.

Picture this: Thanos, a Death-obsessed maniac retconned within the Marvel Cinematic Universe to be the most radical environmental activist in history, has assembled the Infinity Gauntlet. With it, he could wipe out half the universe's population. He raises his hand, snaps his fingers, and... steals a bunch of cryptocurrency instead. The Infinity Gauntlet would still be a problem, sure, but wouldn't that first snap come as a relief?

That's kind of how the recent compromise of JavaScript packages that have been downloaded billions of times feels. Does the ease with which an unknown threat actor was able to compromise the maintainer of these packages, modify the software, and distribute it highlight the disastrous state of modern software development? Absolutely. But we're lucky—they prioritized getting rich over wreaking havoc.

Here's what happened. Aikido said yesterday that 18 packages "were updated to contain a piece of code that would be executed on the client of a website, which silently intercepts crypto and web3 activity in the browser, manipulates wallet interactions, and rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts without any obvious signs to the user."

The packages in question are distributed via npm, GitHub's package manager and registry for the Node.js ecosystem, and they are collectively downloaded approximately 2 billion times per week. In theory, the hacker could have used the ability to modify these packages to do anything; Aikido said they opted to attempt to steal "Ethereum, Bitcoin, Solana, Tron, Litecoin, and Bitcoin Cash."

We don't know how far these malicious packages spread. The packages themselves are downloaded billions of times a week, but that's at least partly a byproduct of software build systems constantly fetching and re-fetching a project's dependencies. There's no denying these packages are popular, though, and organizations whose software depends on them should make sure they aren't using the malicious releases.

But was this at least the result of a sophisticated attack? No. The maintainer of these packages (who, it should be noted, uses the handle "bad-at-computer" on Bluesky) said they received a two-factor authentication reset email that "looked very legitimate" from "support@npmjs.help" and thought it was benign. It wasn't. All it took to pull off a hack of this scale was a domain name, an email, and the willingness to try.

This isn't a new problem, nor is it exclusive to npm. I reported in 2021 that hackers were targeting maintainers of packages used by JavaScript, Python, Ruby, and Java developers in their own software, and even then, the problem had been known for years. The infamous left-pad incident—wherein the deletion of 11 lines of code "broke the internet" because so much software depended on it—happened in 2016.

The industry has been attempting to address this problem by encouraging the use of software bills of materials (SBOMs), requiring maintainers of widely used packages to secure their accounts with two-factor authentication, etc. Yet this incident proves that these measures are not enough. Until the commonly accepted processes of developing, maintaining, and releasing software change, these problems will persist.

This time, the Infinity Gauntlet was used to steal cryptocurrency. Will the next Thanos snap their fingers with the same intention? And which is going to come first, the snap that causes far more damage than a crypto thief, or the arrival of something that can finally stop that snapping altogether? Thanos claimed that he's inevitable; are we really just consigning ourselves to hoping that was only true on the silver screen?

The classic Tetris game has been packaged into a PDF and dubbed Pdftris. The classic falling blocks puzzler is claimed to be playable in most desktop browsers and, indeed, we successfully loaded and played the game in Firefox on PC simply by clicking the above link. A security analyst named Thomas Rinsma is the brains behind this new PDF-based browser game.

Background details on the project aren't extensive, as the GitHub project page ReadMe entry is empty. However, Rinsma was happy to chat with users on the Hacker News feed about the development project.

Rinsma indicates that he was inspired to port a game to run in a PDF after he "realized that the PDF engines of modern desktop browsers (PDFium and PDF.js) support JavaScript with enough I/O primitives to make a basic game like Tetris."

The security analyst and self-confessed aficionado of "strange loops and weird machines" also explained that it wasn't that easy to get his Tetris game to run correctly in both engines. However, he discovered that "showing/hiding annotation 'fields' works well to make monochrome pixels." Moreover, if you try the game with the on-screen buttons and would prefer to use keys, then Rinsma made it so that keyboard control can be achieved by typing in a text input box below the game area.

Rinsma humbly admits that his Tetris in PDF code is "quite janky." However, he suggests it at least serves as a reminder of the power and flexibility of PDF scripting.

Those interested in prying inside the Pdftris code don't need specialist or esoteric development tools. Just choose to download the 60KB PDF, and open it in a text editor and you will find the file is "all ASCII."

There is some source code available, too, with greater readability and comments inserted. You can see that on the aforementioned GitHub project page, specifically here.

Rinsma noted that Pdftris isn't working on Adobe's Reader "likely because it's not compliant in several ways." Other non-browser Pdftris possibilities like Foxit Reader might work, he mused, as he believes it supports the necessary scripting for the gaming action.

It would be great to get some color, shading, and sound in a future release of Pdftris but we don't know if this project will be developed much further. In some ways, it is basically a proof of concept.

While Pdftris is certainly an eyebrow-raising mashup of the gaming and document rendering worlds, developers have dragged far duller apps into the gaming realm, particularly Microsoft Excel. Microsoft's spreadsheet can even host a 3D raytracing gaming engine (with the help of VBA).

When Quake was released in 1996, its minimum requirements were a 75 MHz Intel Pentium processor, 8MB RAM with DOS (or 16MB if you used a Windows 95 PC), and 80MB of available storage. However, Dominic Szablewski has recreated the game in JavaScript for an online competition, producing an executable that is a mere 13KB.

The slimmed-down game, called Q1K3, is hosted on JS13K games — an annual HTML5 and JavaScript game development competition launched in 2012. As you might guess, the competition features a 13KB limit, meaning you can create any game that you want, as long as it fits within this size constraint. Q1K3 was published in 2021, and featured two levels, five different enemies, three weapons, and thirty different textures.

While it doesn’t have the polish of the original Quake game, the Q1K3 browser game delivered about 50% of the fun at 16% of the file size. What’s amazing is how the creator managed to add the lighting effects (no ray tracing here, though), textures, and even the sound effects and music, without using so much space. The in-game enemies also do not have pathfinding, according to the creator, but they still deliver a challenge to players.

The website’s experts had several good things to say about Q1K3. Programmer Ania Kubow said, “There is a lot happening in this game in terms of amount of enemies, weapons and in general level development. I am impressed to see a form of enemy AI being implemented also. Very impressive for 13KB!” Game developer Christer Kaitila also added, “epic and amazing, fun and smooth, fast and polished, completely impressive and wonderfully playable! this is some serious tech, some amazing graphics and music, and it is even complete with particles and gibs, healthpacks and enemy AI w LOS and dynamic lighting around the shots! it even has the dog!!!!!!”

You could spend hours and hours going through the two levels, and the game presents a serious challenge to hardcore gamers who want to go back into nostalgia. Too bad that the game is only designed for desktop: its small size makes it the perfect candidate for mobile gaming and would introduce a new generation to the Quake masterpiece — perhaps it could even lead players to try the Quake Original Remaster.

Szablewski, also known as Phoboslab, joined JS13K in 2018, 2019, and 2021. He submitted Q1K3 in 2021, but he hasn’t joined the competition since then. We hope he can spare the time and effort to get back into the challenge and create more creative games. But we’re also linking the game’s code on GitHub to inspire others to join the competition, too. If you want to give it a try, you can play Q1K3 here.

An urgent pull request was sent out this weekend,to extend the Linux 6.5 kernel’s AMD Zenbleed vulnerability mitigation to Valve’s Steam Deck. It turns out that when the kernel was patched last month, mitigations weren’t implemented for Valve’s custom AMD SoC, sometimes known as Aerith, Phoronix first reported.

AMD’s Zen 2 product stack is pretty complicated, so it is hard to be critical of the Linux dev team. Zen 2 cores debuted with the well-known Ryzen 3000 chips, but the Zen 2 architecture can be also found in some Ryzen 4000 and 5000 processors, as well as Epyc server chips, the Sony PlayStation 5, in the Microsoft Xbox Series X/S consoles, and Valve’s Steam Deck.

It has been three weeks since news of the 'Zenbleed' vulnerability broke. The threat to AMD Zen 2 processor users seemed to be relatively severe. Zenbleed was shown to open up simple remote attack vectors, via JavaScript embedded in a webpage, for example. After successfully exploiting the Zenbleed vulnerability, an attacker could potentially learn your encryption keys or web logins.

If you care to head on over and look at the notes of the pull request you will see that a developer notes that “the AMD Custom APU 0405 found on Steam Deck was not listed, although it is clearly affected by the vulnerability.” The dev then goes on to request the Steam Deck’s CPU is added to the Zenbleed list “in order to unconditionally enable the fallback fix until a proper microcode update is available.”

This last point is important to note. AMD hasn’t provided any of its official patches for Zenbleed as yet, except to the EPYC 7002 'Rome' processors. Everyone else will have to wait until November / December this year. The chipmaker said that it is not aware of any Zenbleed exploits outside of the research environment. Some assume that microcode updates will be able to fix the Zenbleed vulnerability with little or fewer performance penalties than a software patch would, but that remains to be seen.

A performance decrease isn't ideal for a gaming machine, but with access to web browsers from the Steam side and a full desktop on the KDE Plasma desktop side, the Steam Deck is a full-on Linux computer.

It seems like the favorite processor families of PC DIYers have been plagued with newly uncovered bugs recently. In addition to Zenbleed, last week we reported on both (Intel) Downfall and (AMD) Inception.

Once you’ve created a list or collection in Python, it might be useful to have each item numbered. Instead of going through the list manually and adding numerals one by one, it can be well worth looking into the enumerate function. This is a built-in tool that will go through a list and automatically number them in the order they were added to the tuple or list.

In this guide, we’ll go over how to use this enumerate function with an existing list. We’ll assume you already have familiarity with how to create a variable, list, and use functions. Once the list has been enumerated, it can be called later with the enumeration in place. You can even use a for loop (see how to use for loops in Python) to iterate through the enumeration.

What is Enumeration in Python?

Enumeration is the ordered listing of all items in a collection. In Python we can use this with a list or tuple to (data collection objects) into an enumerate object. The enumerate object has a name and value for each enum member within the object. The enumerate object can be updated (mutable) unlike other objects such as tuples which are immutable (cannot be updated).

How to Enumerate in Python

To demonstrate how to use enumeration in Python, we’ll start with a list of flavors and label it ‘flavors’. After applying the enumeration function, we’ll print the list which will show that each item has been marked with a numeral sequentially.

1. Create a list, collection or tuple. In this case we have three flavors in a list labeled as a variable named ‘flavors’.

flavors = ('Raspberry', 'Vanilla', 'Chocolate')

2. Run the enumerate function. In the example code below, we’ve created a variable named ‘choices’ that consists of the enumerate function parsing the ’flavors' object, as an argument.

flavors = ('Raspberry', 'Vanilla', 'Chocolate')choices = enumerate(flavors)

3. Print the list. You can now call the 'flavors' object as needed in your code. For the sake of our example, we’ll print the list to show what it looks like when the list has been enumerated.

flavors = ('Raspberry', 'Vanilla', 'Chocolate')choices = enumerate(flavors)print(list(choices))

4. Confirm the results. The printed list should appear as follows if the enumeration was successful.

[(0, 'Raspberry'), (1, 'Vanilla'), (2, 'Chocolate')]

Even though we’ve printed the list to show the enumerate function, this is just to demonstrate how it works. You can apply it in your code as needed after the second step but printing the list is a quick way to make sure it’s working as intended.

We earlier mentioned that enumerated collections have a value and name associated to the data stored within. We can individually extract these values. Here is a quick example that creates an enumerated collection of foods.

1. Import the enum module. 

import enum

2. Create a new enumeration object using a function-call syntax. Our object is called food, and in there we store a list of foods. By using the enum.Enum function call we bind  values to each of the item names.

food = enum.Enum('food', ['Tomato', 'Cucumber', 'Chocolate'])

3. Use a for loop to print the value and name of each item in the object. The for loop will iterate over every item in the object. We then print the value and name of the item.

for item in food:    print(item.value, item.name)

4. Run the code. The output will be the enumerated value of the item's position and the name of the item.

1 Tomato2 Cucumber3 Chocolate

Using Enumeration to Number Chapters in a Book

There are plenty of practical applications for applying numbers to a list. In this example, we'll number the chapters in a book we're pretending to write. This example also shows how you can start a list from any number so it doesn't begin with the default value of 0.

I'll be using Thonny for this example. It's a free Python editor that works on several platforms. You can find it available for download on the official Thonny website. However, you can use any editor you like for your project.

1. Make your list. In this case, my list is a handful of fake chapters for our book.

chapters = ["How to Enumerate in Python", "Creating a List", "Enumerating the List"]

2. Set the beginning of the list to 1 instead of 0. The next line tells Python that we want the chapter enumeration to begin at 1. The words 'chapter' and 'title' can be anything you like.

chapters = ["How to Enumerate in Python", "Creating a List", "Enumerating the List"]for chapter, title in enumerate (chapters,1):

3. Print the list. The third line prints the chapter variable which has the title argument setting the list to begin at 1.

chapters = ["How to Enumerate in Python", "Creating a List", "Enumerating the List"]for chapter, title in enumerate (chapters,1):print(chapter, title)

4. Run the program. It should print the chapters with the enumeration beginning at 1.

Python How Tos

• How To Install Python on Windows 10 and 11
• How to use For Loops in Python
• How to Enumerate in Python
• How to Create Executable Applications in Python
• How To Remove Backgrounds From Images With Python
• How to Create Web Apps with Python, HTML and Thonny
• How To Use Raspberry Pi Camera Module 3 with Python Code

In programming, for loops are incredibly versatile tools to repeat a section of code. For loops can loop for a set number of times using a range, they can have clauses / conditions which will end the loop and we can use them to iterate over items in a dictionary, list or tuple.

In this how to, we will show you how to get started with for loops using Python, the same syntax will also work with MicroPython and CircuitPython on boards such as the Raspberry Pi Pico.

To demonstrate how to use for loops in Python, we will use Thonny, a free, easy to use and cross platform Python editor. 

1. In a browser go to the Thonny website and download the release for your system.

2. Alternatively, install the official Python release using this guide. Note that this guide covers installation on Windows 10 and 11.

Using a Range with Python For Loops

The most basic for loop use in Python is to iterate over a range, essentially creating a loop that will only iterate for a set number of times. While “range” is not strictly part of the syntax for a for loop, it is really a built-in Python function that returns a sequence for a specific pattern, it is the easiest way to demonstrate how a for loop works.

1. Create a for loop and set the range to 10.This will set the value of x to an integer value, starting at 0 and ending at 9. The loop will iterate until it reaches the tenth loop, then it will end.

for i in range(10):

2. Print the current value of i as part of a sentence. Here we use Python’s string format method to insert the loop number each time the loop iterates.

   print("This is loop: {:n}".format(i))

3. Save the code as for_loop_range.py and click Run to start. You should see this output.

This is loop: 0This is loop: 1This is loop: 2This is loop: 3This is loop: 4This is loop: 5This is loop: 6This is loop: 7This is loop: 8This is loop: 9

Complete Code Listing: For Loop With a Range

for i in range(10):    print("This is loop: {:d}".format(i))

Using a For Loop With RSS Feeds

To better illustrate how we can use a for loop, let's use a for loop with a range to pull the top five headlines from BBC News’ RSS feed along with their corresponding URL.

1. Install feedparser using pip at a command prompt. Feedparser is an RSS parsing tool that we shall use to read the RSS feed and convert it into a Python dictionary.

pip install feedparser

2. In Thonny, create a new blank Python file and import feedparser.

import feedparser

3. Create an object, newsfeed, and in there store the parsed BBC News feed.

newsfeed = feedparser.parse("http://feeds.bbci.co.uk/news/rss.xml")

4. Use a for loop with a range of five.

for i in range(5):

5. Print the headlines (title) and the URL (link) of the top five stories. Here we are accessing the newsfeed object, which is a dictionary (array) that contains many more dictionaries and lists. Using the keys (entries, title and link) we can get the values that they store. The value of [i] increments, until it reaches 5, then the loop ends. We have how tos covering dictionaries and lists which go into further detail.

   print(newsfeed['entries'][i]['title'])   print(newsfeed['entries'][i]['link'])

6. Save the code as news_for_loop.py and click Run. You should see the top five news headlines.

Complete Code Listing: Using a For Loop With RSS Feeds  

import feedparsernewsfeed = feedparser.parse("http://feeds.bbci.co.uk/news/rss.xml")for i in range(5):    print(newsfeed['entries'][i]['title'])    print(newsfeed['entries'][i]['link'])

For Loops With an Early Exit

Ranges can also feature an “early exit”. This uses a conditional statement that checks the value of the of the loop (in our case it is stored in i) and if it matches the value, the code breaks and exits.

We’re going to reuse the code from the first example to start us off.

1. Add a conditional test that checks the value of i is the same as 4. In Python == is an operator that checks that one value is the same as another.

   if i == 4:

2. Print a sentence to inform the user that the loop is terminating. This part of the code will only activate once “i” contains the value 4.

       print("This loop sequence terminates at loop {:n}".format(i))

3. Break the loop, forcing the code to stop.

       break

4. Save and run the code. You should see this output.

This is loop: 0This is loop: 1This is loop: 2This is loop: 3This is loop: 4This loop sequence terminates at loop 4

Complete Code Listing: For Loop With an Early Exit

for i in range(10):    print("This is loop: {:n}".format(i))    if i == 4:        print("This loop sequence terminates at loop {:n}".format(i))        break

Nested For Loops

We can have multiple for loops running together. For example we can nest one for loop inside of another. In this example we are reusing the code from the first example.

for i in range(10):   print("This is loop: {:n}".format(i))

1. Add a nested for loop that will iterate ten times. Ensure that the variable name is different to the main loop, otherwise the two will clash.

   for j in range(10):

2. Add a print statement to inform the user that this is the nested for loop.

       print("This is nested loop: {:n}".format(i))

3. Use a break to exit out of the nested for loop. If we don’t do this, then the nested for loop will repeat each time the main loop iterates.

       break

4. Save and run the code. You should see this output.

This is loop: 0This is nested loop: 0This is loop: 1This is nested loop: 1This is loop: 2This is nested loop: 2This is loop: 3This is nested loop: 3This is loop: 4This is nested loop: 4This is loop: 5This is nested loop: 5This is loop: 6This is nested loop: 6This is loop: 7This is nested loop: 7This is loop: 8This is nested loop: 8This is loop: 9This is nested loop: 9

Complete Code Listing: Nested For Loops

for i in range(10):   print("This is loop: {:n}".format(i))   for j in range(10):       print("This is nested loop: {:n}".format(i))       break

Iterating With For Loops

Iterating over objects in a list, dictionary or tuple is useful if we want to use data from these objects. In this example, we will reuse the code from our RSS feed reader to create a simple web app. A ranged for loop will grab the news headlines from the object, then split the headlines and their URLs apart and then store them inside of a Python dictionary object. Then we will use the dictionary as a source to generate an HTML page in a browser.

1. Install PyWebIO using pip at the command prompt,. PyWebIO is a means to create inputs and outputs around a browser session.

pip install pywebio

2. In Thonny, create a new blank Python file and import feedparser and import three PyWebIO classes. PyWebIO has many different classes and functions, but we are interested in creating a server, outputting information to a browser and controlling the session.

import feedparserfrom pywebio import start_serverfrom pywebio.output import *    from pywebio.session import *

3. Create an object, newsfeed, and in there store the parsed BBC News feed. This can be any RSS feed that you choose.

newsfeed = feedparser.parse("http://feeds.bbci.co.uk/news/rss.xml")

4. Create an empty dictionary called news_stories. Dictionaries are Python objects that store data using a key, value system. By calling a dictionary and referencing a key, we can get the value attached to it.

news_stories = {}

5. Using a for loop with a range, grab the first five news stories and store them inside the news_stories dictionary. The title (headline) will be the key, and the URL will be the value.

for i in range(5):   news_stories.update({newsfeed['entries'][i]['title']:newsfeed['entries'][i]['link']})

6. Create a function called main. This function will handle creating the web content to be served.

def main():

7. Set the page title. This is seen in the tab / title bar of the web browser.

   set_env(title='Python For Loops RSS Example')

8. Use a for loop to iterate over every key (k) and value (v) stored in the news_stories dictionary. The for loop will end once it has retrieved all of the keys and values, it does not need a range.

   for k,v in news_stories.items():

9. Place the headline text on the page. PyWebIO’s put_text function places raw text on a web page, and we pass the function the key value, which is the headline.

       put_text(k)

10. Place the URL underneath the headline. Using put_link we generate an HTML hyperlink with the text “Click here”. The URL is created from the value stored in v.

       put_link('Click here',v)

11. Outside of the for loop and the function, start the server. Call the main function and set the port to 8080, and debug to True. It is advisable to set the port to an unused value and typically 8080 is valid. If necessary change this to another value. Setting debug to True is useful as it provides output in the Python shell, and in the browser session.

start_server(main, port=8080, debug=True)

12. Save the code as for_loop_news_dict.py and click Run. The Python shell will display the URL of the generated page.

13. Click on the URL to open in your default browser. The URL can also be viewed from another device on the network.

Complete Code Listing: Iterating With For Loops

import feedparserimport timefrom pywebio import start_serverfrom pywebio.output import *    from pywebio.session import *newsfeed = feedparser.parse("http://feeds.bbci.co.uk/news/rss.xml")news_stories = {}for i in range(5):   news_stories.update({newsfeed['entries'][i]['title']:newsfeed['entries'][i]['link']})def main():   set_env(title='Python For Loops RSS Example')   for k,v in news_stories.items():       put_text(k)       put_link('Click here',v)start_server(main, port=8080, debug=True)

Python How Tos

• How To Install Python on Windows 10 and 11
• How to use For Loops in Python
• How to Enumerate in Python
• How to Create Executable Applications in Python
• How To Remove Backgrounds From Images With Python
• How to Create Web Apps with Python, HTML and Thonny
• How To Use Raspberry Pi Camera Module 3 with Python Code

Update 7/24/23 5:40pm PT: Added a statement from Google and also a full list of all impacted processors and the expected dates for patches for each model.

Update 7/24/23 1:30pm PT: AMD has responded with key details and published a security advisory with the expected dates for new firmwares, many of which don't arrive until the end of the year. We have added that information to the original article below. 

Original Article Published 7/24/23 8:45am PT:

Tavis Ormandy, a researcher with Google Information Security, posted today about a new vulnerability he independently found in AMD's Zen 2 processors. The 'Zenbleed' vulnerability spans the entire Zen 2 product stack, including AMD's EPYC data center processors and the Ryzen 3000/4000/5000 CPUs, allowing the theft of protected information from the CPU, such as encryption keys and user logins. The attack does not require physical access to the computer or server and can even be executed via javascript on a webpage.

AMD didn't have an advisory ready at the time of publication, but the company did add the AMD-SB-7008 Bulletin several hours later. AMD has patches ready for its EPYC 7002 'Rome' processors now, but it will not patch its consumer Zen 2 Ryzen 3000, 4000, and some 5000-series chips until November and December of this year. AMD's processors used in the PS5, Xbox Series X and S, and Steam Deck are all also powered by Zen 2 chips, but it remains unclear if those are impacted. We're following up for more details. We have added details further below about mitigation schedules. 

AMD hasn't given specific details of any performance impacts but did issue the following statement to Tom's Hardware: “Any performance impact will vary depending on workload and system configuration. AMD is not aware of any known exploit of the described vulnerability outside the research environment.”

AMD's statement implies there will be some performance impact from the patches, but we'll have to conduct independent benchmarks when the patches arrive for the consumer Ryzen products. In the meantime, we've asked AMD for any ballpark figures it can share.

The Zenbleed vulnerability is filed as CVE-2023-20593 and allows data exfiltration (theft) at a rate of 30kb per core, per second, thus providing adequate throughput to steal sensitive information flowing through the processor. This attack works across all software running on the processor, including virtual machines, sandboxes, containers, and processes. The ability for this attack to read data across virtual machines is particularly threatening for cloud service providers and those who use cloud instances.

The attack can be accomplished via unprivileged arbitrary code execution. Ormandy has posted a security research repository and code for the exploit. The attack works by manipulating the register files to force a mispredicted command (meaning it eploits the speculative execution engine), as described below:

"The bug works like this, first of all you need to trigger something called the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper. This all has to happen within a precise window to work.

We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever!

This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file," says Ormandy.

AMD describes the exploit much more simply, saying, "Under specific microarchitectural circumstances, a register in “Zen 2” CPUs may not be written to 0 correctly. This may cause data from another process and/or thread to be stored in the YMM register, which may allow an attacker to potentially access sensitive information."

Ormandy says the bug can be patched through a software approach for multiple operating systems (e.g., "you can set the chicken bit DE_CFG[9]"), but this might result in a performance penalty. Ormandy says it is highly recommended to get the microcode update, but his post also has examples of software mitigations for other operating systems, too.

Here's a list of the impacted processors, and the schedule for the release of the AGESA versions to OEMs: 

Below, we have a more detailed list with the model number of each impacted chip and the expected data for the new AGESA to arrive. AMD's AGESA is a code foundation upon which the OEMs build BIOS revisions. You will need to update to a BIOS with the above-listed AGESA code, or newer, to patch your system.

“We are aware of the AMD hardware security vulnerability described in CVE-2023-20593, which was discovered by Tavis Ormandy, a Security Researcher at Google, and we have worked with AMD and industry partners closely. We have worked to address the vulnerability across Google platforms.” - Google spokesperson to Tom's Hardware.

Ormandy says he reported the issue to AMD on May 15, 2023. Ormandy also credits his colleagues; "I couldn’t have found it without help from my colleagues, in particular Eduardo Vela Nava and Alexandra Sandulescu. I also had help analyzing the bug from Josh Eads."

A new plugin mod for CD Projekt Red's divisive (yet culty) Cyberpunk 2077 has been launched that's likely the one mod to mod them all. CyberAI, as it's been named by its creator, "tomatojuice", enables integration between the neo-chrome of Cyberpunk 2077 and the synthetic abilities of OpenAI's ChatGPT. 

Available on NexusMods, CyberAI promises to bring worlds of synthetic content to anyone curious enough to try: using the console, users will be able to query OpenAI API methods from Lua or Redscript, essentially allowing you to bring ChatGPT's scripting abilities to code extreme modifications. "tomatojuice" lists a few things the tool can be used for, like creating custom NPC (Non-PLayer Character) dialogue; Dynamic Plot Generation, which enables creating entire storylines and sidequests based on in-game events or player actions; Procedural Mission Planning, which generates new missions with in-game context, NPC data (which can be custom itself), and other player preferences; and the creation of interactive environments, which through AI generates more dynamic environment conditions while enhancing the interaction between elements.

Of course, it'd be a pity not to improve the game's own AI routines — the ones that control NPC behaviors and game simulation responses to events. These have been found to be somewhat of a miss with Cyberpunk 2077 (at least that perception will remain until the release of the game's next expansion, Liberty City, and the depth of its promised AI improvements). But with the ability to edit the enemy's AI behavior, users can script entire worlds within Cyberpunk 2077.

For example, you could create a script that verifies whether the player character kills a custom NPC; if so, that event then triggers a ChatGPT-generated storyline that can essentially interact with every mechanic employed by Cyberpunk 2077. A low-gravity mission against a group of chromed, monk cultists that are attempting to uncover whether their world is a video game simulation played in someone's bedroom PC in the year 2023? 

You can go and create that right now.

As "tomatojuice" stresses, imagination really is the limit. And there's even added flexibility to connect to other LLMs (Large Language Models) other than OpenAI's ChatGPT. That truly brings anyone's options through the proverbial roof: you can create custom missions that have NPC dialogue written by ChatGPT or Anthropic's generally more friendly Claude, of which version 2 was just launched. That way, you'd have different modalities between each model you add into the mix, making the world even more varied.

And it may sound impossible, but you can actually do even more than that: you can use one of our guides and create your personal ChatGPT, training it on data of the experiences you've loved the most. Feed it your favorite scripts, your favorite plotlines, books, and even personal journals, and see NPCs surround you that actually know you and respond with knowledge of your universe.

Your own Cyberpunk, whatever that means to you.

Maybe Google should call its annual developers' conference Google A/I instead of Google I/O, because the company is all about embracing generative AI this year. Google debuted its latest language model, Pathways Language Model 2 or PaLM 2, which now fully-powers Bard, Google's AI chatbot rival to Microsoft's ChatGPT-powered Bing chatbot. 

According to Google, the new PaLM 2 language model has better math, logic, and reasoning skills, and is especially good at coding as it's learned over 20 programming languages — including "C++, Go, JavaScript, Python, Kotlin, and even Google Sheets Functions," said vice president and general manager of Google Assistant and Bard, Sissie Hsiao. Bard can now not only write code, but also explain specific functions and answer questions about how to fix or improve code — and the resulting code snippets can be sent to Google's Colab or Replit for easy collaboration. If it pulls code from another source, it will also now cite that source.

Hsiao also said Bard will become "more visual" in the next few weeks, both in responses and prompts. This means Bard search results will start returning images for relevant queries, and also that people will be able to prompt bard "with images" using Google Lens integration. Hsiao demonstrated this with a photo of two dogs and the prompt "write a funny caption about these two," so you'll still need to prompt Bard with words in addition to the images (I'm not sure what I was thinking, but prompting Bard "with images" initially sounded much more exciting in my head).

Google will also be collaborating with third-parties to add features to Bard, such as text-prompted image generation thanks to integration with Adobe Firefly. The company is calling these "tools" and showed a graphic with several companies' logos including Kayak, OpenTable, Tripadvisor, Spotify, and Walmart. Finally, Google has dropped the waitlist and Bard is now available in 180 countries and has added support for prompts in Japanese and Korean.

Duet AI for Google Workspace

Google also demonstrated its new AI-powered toolset for Google Workspace (Google's suite of productivity apps, which includes Gmail, Docs, Slides, Sheets, and Meet), which it's now calling "Duet AI for Google Workspace" (the toolset, not Workspace). It's called "Duet AI" because Google imagines that you'll be collaborating with AI, like you collaborate with coworkers and other humans in Workspace apps right now. 

Google actually first announced the upcoming Duet AI tools in a blog post back in March, but most of them — save for the writing assistant tool "Help me write" — are still unavailable to the public. The upcoming tools will let users do things like generate summaries from notes, create images from text prompts within Google Slides, create templates from text prompts in Google Sheets, and create custom backgrounds in Google Meet.

Google also demonstrated a future 'Sidekick' panel that will be able to read your content and "engage" with you using contextual prompts. Google Workspace VP and GM Aparna Pappu demonstrated this feature with an unfinished children's story. Asking the Sidekick for help (don't worry, it's not going to prompt you without solicitation) generated some questions about what might happen next.

Most of the new Workspace tools aren't available to the public yet, and will be rolling out selectively over the next few months. If you're interested in potentially getting early access to test out these features, you can sign up for the Google Labs waitlist here.

When we think about Raspberry Pi, we normally picture single-board computers, but the Raspberry Pi Foundation was started to help kids learn about computers and it wants to help whether or not you own its hardware. The non-profit arm of Raspberry Pi this week released its new, browser-based code editor that's designed for young people (or any people) who are learning.

The Raspberry Pi Code Editor, which is considered to be in beta, is available to everyone for free right now at editor.raspberrypi.org. The editor is currently designed to work with Python only, but the organization says that support for other languages such as HTML, JavaScript and CSS is coming.

I tried out the Code Editor on my PC's browser and, in its current form, there's nothing particularly unique about it. However, I found the UI very user-friendly and was impressed with how it is integrated into someone online tutorials. The interface consists of three panes: a list of files in your project, a code editor and an output pane that runs the result of your code when you hit the Run button.

If you create a free account on raspberrypi.org, which I did, the system will save all of your projects in the cloud and you can reload them any time you want. You can also download all the files in a project as a .zip file. 

Since the entire programming experience takes place online, there's no way (at least right now) to use Python to control local hardware on your PC or your Raspberry Pi. If you want to attach one of the best Raspberry Pi HATs or use the GPIO pins on your Pi to light up an LED light, you need a local editor like Thonny, which comes preinstalled on all Raspberry Pis and is a free download for Windows, Mac and Linux.

The Raspberry Pi Code editor isn't the only online Python editor around by any stretch of the imagination as you can also use a service such as Trinket.io, which will let you write Python code in one pane while previewing it in another. However, what's interesting about Raspberry Pi's tool is that the organization has a few Python tutorials that are designed to be used with it.

The Raspberry Pi Foundation already had a nice set of Python tutorials on its site, but it has adapted some of them to open sample code directly in the online editor. For example, when I tried the "Say hello" lesson, the first link on the page opens the working set of code in the editor in a new tab in my browser. When I revisited the page and clicked the link a few minutes later, it took me back to the same code I had edited before, because it saved the lesson as a project that was associated with my account.

I had fun writing a simple Python script that printed "Tom's Hardware was here" to screen and repeated it 500 times. The editor supports using emojis in your output and the sample code gives you some emojis you can copy and paste into your commands.

At present, the Editor only works with the first two lessons in Raspberry Pi Foundation's "Intro to Python" learning path. However, you can use all of the lessons with Trinket or another editor and I'm sure they will integrate the new editor into all of the lessons soon.

The Pi Foundation says that it plans to add a number of features to the Code Editor, including sharing and collaboration. The organization also plans to release the editor as an open-source project so anyone can modify it. Based on my brief experience testing it, I can say that it seems like it will be a great learning platform for new coders, especially when used with the tutorial paths on raspberrypi.org.

The GurgleApps team is back with another cool Raspberry Pi Pico W project: a Pico W-based web server. But this project does more than serve web pages — it can also run your Python code on the Pico W via a web interface.

The web server is accessible by any device with a web browser, on a local or external network. The project is coded in MicroPython and at a basic level it works with two files. Wi-Fi configuration details are stored in config.py, and the project code is stored in main.py (which MicroPython will autorun when powered on). 

The clever part of this project is the abstraction. Rather than bog the user down with complexities, the team has created its own webserver module (gurgleapps_webserver.py) which the project code imports and uses.
Abstracting code is a good way of getting users comfortable with a project / language before pulling back the curtain to reveal the complexities of a powerful language.

GurgleApps demonstrates the web server by bundling a project to control the Pico's onboard LED using a rather responsive web interface. Crafting a custom URL, advanced users can directly access the function and control the LED. This advanced approach also returns a JSON object to the user, which, in this case, tells us the current delay (blinking on / off) of the LED and the LED's current state. Other example projects include a frequency generator which was used in a Physics experiment to visualize vibrations in sand (or polenta). The frequency data is also displayed on a tiny OLED screen.

The team then goes into great detail on how to create your own functions which can be called via the web interface. This detail is what sells the project — using not very much code we can create a web interface for a robot or see real-time sensor data in a web page.

The user interface is created using HTML and CSS. These files are stored in the www directory of the project's Pico download. Changing the graphics and layout of the user interface would be a quick and easy task for most learners.

It is great to see the GurgleApps team building another simple-yet-powerful project based around our favorite microcontroller. You can learn more about the project via the GurgleApps blog and find all of the raw code this GitHub repository.

Windows 95 was certainly a breakthrough moment in operating system design, bringing so many of the things we take for granted today to PCs, such as the desktop and the Start button. This week, Microsoft announced the latest 22H2 updates for Windows 10, and gave us a flash of a possible Windows 12 at the Ignite conference — and it might make you wonder if Windows 95 really was all that innovative (or if nostalgia has rose-tinted your memories). 

Well, now you can find out: Slack developer Felix Rieseberg has created a cross-platform Windows 95 that runs as an app, and it’s just reached version 3.1.1. (Thanks to Betanews for bringing this to our attention.) 

And yes, it can run Doom. 

It’s all done through the magic of Electron, GitHub’s open-source software framework used to create desktop apps out of web technologies such as CSS and JavaScript, which is what Rieseberg has used here. Download the .exe file (for Windows — Linux and Mac versions are available). It simply executes without an installation, and pops up the familiar, if old-fashioned, desktop with a welcome message open in Notepad.

Installed software includes Netscape Navigator, as well as classic games such as Wolfenstein 3D, A10 Tank Killer, and Doom. This project displays Electron’s capabilities for creating cross-platform apps with versions for Windows (32-bit, 64-bit, ARM64), Mac (Intel, Apple M1), and Linux (64-bit, ARM64, ARMv7). 

It runs reasonably well — though the author admits it would be even better as a native app. In a cursory test, we found the mouse pointer to be erratic, and Doom got stuck on the menu screen.

As the third release of the portable OS, this Windows 95 sees an update to Electron v18, and also moves to a newer version of the v86 virtualization app that emulates an x86 processor. The new version uses the WebAssembly language and also fixes a few bugs. You can even add new apps to by mounting hard drive images — though if you’ve got a project-critical Windows 95 app, you’re better off with a VM or even an old PC. If you’re using Linux, you can run it in Docker.

On his GitHub page, Rieseberg apologizes for what he’s done, and adds: “Bear in mind that this is written entirely in JavaScript, so please adjust your expectations.” The app is available under an educational license, and has no approval from Microsoft. Download it from GitHub.

Before the Raspberry Pi came on to the scene, the Arduino was the de facto standard for electronics hobbyists. Over the years the boards may have changed (including an RP2040 based board) but the IDE has remained largely the same.
Today Arduino has announced the availability of version 2.0 of its integrated development environment, or IDE. In beta since early 2021, the code editor has been developed with the help of community feedback, and brings enhancements and new features including faster compilation.

The new app offers a refreshed UI that now includes a dark mode, and Arduino cloud integration means your sketches - Arduino-speak for programs - can be accessed from multiple devices. The Remote Sketchbook feature also includes an online code editor, so you can write straight into your browser. The Serial Monitor and Plotter views can now be accessed at the same time for both text-based and graphically presented insights. The Serial Plotter is now a richer and more versatile variable-tracking tool, useful for testing and calibrating sensors and visually representing analog voltages.

Code autocompletion also features in the 2.0 release, with variables and functions suggested by the app according to the existing code and any libraries you’ve included. This feature alone is worth the upgrade, There's also a right-click menu that can provide navigation shortcuts to the line and file where variables and functions are declared. It also helps coders to spot errors as they type, as well as speeding up code generation in general. Code assist is one of the ‘weak spots’ in the Arduino system identified by user feedback, and so has been made “all better”, according to the announcement post. Other weak spots include compilation time and serial output, which have received commensurate amounts of attention and polish.

Arduino makes a full range of microcontroller hardware for use in electronics projects, and the IDE can also be used to create code for the Raspberry Pi Pico. Full documentation for the new release can be found on the Arduino website, while the IDE itself can be downloaded from the download page for Windows, Mac and Linux. Chromebooks aren’t directly supported, but their users can get in on the fun with the web editor.

If you’re not looking to set up a major website on a hosting service, you can easily run a web server in your home. We’ve previously explained how to set up a Raspberry Pi web server using a regular Pi 3, 4 or Zero, but you don’t even need a full Pi to get the job done. With the Raspberry Pi PIco W, a Wi-Fi enabled micro controller that costs just $6, you can do some basic web serving. 

The Raspberry Pi Pico W isn’t the most obvious choice, but with a little MicroPython code, and some HTML, we can serve basic, static web pages from a Pico W. There are two parts to this project. The HTML and the MicroPython code. The HTML is what our browser will see, and MicroPython acts as the means to serve the code.   

For this project we will host a basic web page from a Raspberry Pi Pico W. We will also demonstrate how to add a little more sparkle to your pages with CSS and JavaScript. Finally we will serve the content to the world by learning how to forward external requests to our Raspberry Pi Pico W.

For this project you will need 

• A Raspberry Pi Pico W 

HTML for Raspberry Pi Pico W Web Server

HyperText Markup Language (HTML) is the basic building block for the web. The language is a framework for creating web pages, a framework that has since been updated and improved for more modern sites.

The HTML for our Pico W web server can be as simple or complicated as you wish, but there are a couple of caveats to consider. The HTML for the site is loaded into a Python variable, so that means we can’t go too overboard with features as the Pico W only has 264KB of SRAM. Secondly we cannot serve images or reference files (CSS/JavaScript) on the Pico W as again we load the HTML into a Python variable which cannot access the filesystem. 

This means that any images or CSS/JavaScript will need to be accessed from a remote site. CSS and JavaScript in the HTML code will work, but we preferr to reference Bootstrap CSS and JavaScript via its CDN.

To create a basic HTML page

1. Open a text editor of your choice. Notepad is ample, but our preference is Notepad++.

2. Set the document type to HTML and then create an html tag. This tells the browser that the page is written in HTML, and the tag denotes the start of the HTML document.

3. Create a new tag, , and inside the head use

4. Create a section. This is the section where the user visible content is displayed.

5. Create a headline using the

tag and give your page a headline / title. This is the largest headline tag.

Tom's Hardware Pico W Web Server

6. Add another headline using

and give the section a name. In our example, it’s  “The Latest News.” The

tag is smaller than

but it still emphasizes that this is a new section.

The Latest News

7. Insert an image, linked to from a remote CDN, using the tag. We need the full URL for the image that we wish to use, ensuring that we also have permission to use the image. In our example we are using an image from Pexels.com, a free license image service. Images can be resized using the tag. We can specify the size as a percentage of its original size, or we can hard code the size in pixels.

8. Use the

tag to create a paragraph of text. For our demo we used two paragraphs of Lorem Ipsum generated using a Lorem Ipsum generator.

Lorem ipsum dolor sit amet, consectetur adipiscing elit…..

9. Finally close the body and then the HTML document.

10. Save the file as index.html.

For now keep the code in this file, we will use it later.

Python Code for Raspberry Pi Pico W Web Server

We have created a page for our eager readers, and now we need to create a means to serve it to them. For this we will create a short MicroPython application that will read the contents of our index.html file and serve it as a web page.

1. Follow this guide to setup your Raspberry Pi Pico W. Follow the steps until “How to blink an LED”.

2. Create a new blank file.

3. Import two modules. The first is socket, a low level networking interface. The second is network, which we shall use to connect to our Wi-Fi access point.

import socketimport network

4. Create an object, page, and use it to reference the HTML file on our Pico W. This will open the file in read only mode.

page = open("index.html", "r")

5. Read the contents of the file into a new object, html, then close the file. This will read all of the HTML into the html object.

html = page.read()page.close()

6. Create an object, wlan, and use it to create a connection from our code to the Wi-Fi chip on the Pico W.

wlan = network.WLAN(network.STA_IF)

7. Turn the Wi-Fi on and then connect to your access point with your password.

wlan.active(True)wlan.connect("ACCESS POINT","PASSWORD")

8. Create an object, sta_if, which will serve as our interface between the Pico W and the Wi-Fi access point.

sta_if = network.WLAN(network.STA_IF)

9. Print the Pico W’s IP address, make a note of the IP address as we will need this later. The returned data is a list object that contains our IP address, netmask and DHCP server address. The IP address is the first item in the list so using [0] we can return it from the list without any other information.

print(sta_if.ifconfig()[0])

10. Set the Pico W to listen for connections on port 80 from any IP address. We use socket.SO_REUSEADDR to enable the same IP address to be used after a reset. This remedies an issue where the Pico W would need a full power down in order to re-use the IP address.

addr = socket.getaddrinfo('0.0.0.0', 80)[0][-1]s = socket.socket()s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)s.bind(addr)s.listen(1)

11. Create a loop to continually run the next section of code.

while True:

12. Set the Pico W to accept a connection and to create a file that will become our web page.

   cl, addr = s.accept()   cl_file = cl.makefile('rwb', 0)

13. Create another loop, and inside the loop create an object, line, to read the contents of our web page, line by line.

   while True:       line = cl_file.readline()

14. Use a conditional statement to stop reading the contents if there are carriage returns or line breaks.

       if not line or line == b'\r\n':           break

15. Create an object, response, in which we store the HTML for the web page.

   response = html 

16. Set up a client response that sends the HTTP status code, and content type to the browser, then responds with the HTML to be rendered in their browser. The connection is then disconnected.

   cl.send('HTTP/1.0 200 OK\r\nContent-type: text/html\r\n\r\n')   cl.send(response)   cl.close()

17. Save the file to the Raspberry Pi Pico W as main.py. By doing this the code will autorun when the Pico W boots.

Complete MicroPython Code Listing

import socketimport networkpage = open("index.html", "r")html = page.read()page.close()wlan = network.WLAN(network.STA_IF)wlan.active(True)wlan.connect("ACCESS POINT","PASSWORD")sta_if = network.WLAN(network.STA_IF)print(sta_if.ifconfig()[0])addr = socket.getaddrinfo('0.0.0.0', 80)[0][-1]s = socket.socket()s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)s.bind(addr)s.listen(1)while True:    cl, addr = s.accept()    cl_file = cl.makefile('rwb', 0)    while True:        line = cl_file.readline()        if not line or line == b'\r\n':            break    response = html         cl.send('HTTP/1.0 200 OK\r\nContent-type: text/html\r\n\r\n')    cl.send(response)    cl.close()

Copying index.html to the Raspberry Pi Pico W

1. In Thonny, click on View >> Files. This will open a file manager. The top window is the source, in this case the main drive of our PC. The bottom window is the target, the Raspberry Pi Pico W.

2. In the top window navigate to the location of your index.html file.

3. Right click on index.html and select “Upload to /” to copy the file to your Pico W.

4. Unplug the Pico W from your computer, then reinsert to reboot the Pico W and start the web server.

5. On your PC, open a new browser window / tab and go to the IP address of your Pico W. After a few moments you will see the page appear in the window.

Improving our HTML

Using Bootstrap and its CDN we created a much more professional looking page. Essentially this uses the same basic

,

and elements, but with extra features such as dividers and custom CSS. 

Bootstrap is a framework for HTML, CSS and JavaScript that produces professional looking sites quickly. If you want to build a quick demo site for clients, or your own projects, Bootstrap is a good place to start.

We adapted the Heroes template for our demo, replacing the CSS and JavaScript links for BootstrapCDN links.

If you would like to use our code, it can be downloaded from here.

Forwarding Requests to our Raspberry Pi Pico W Web Server

Right now our server is only accessible to devices on the same network. To share our Raspberry Pi Pico W web server with the world we need to ascertain our external IP address and set up port forwarding to send external requests to our Pico W.

Every router has a subtly different means to do these tasks, our steps illustrate how our ISP provided router handles it.

 1. Get your external IP address. Using Google’s search engine and search for “What is my IP address?” and make a note of the IP address.

2. Log into your router’s Advanced Settings and select DHCP Reservation. We need to ensure that our Pico W has a static IP address on the LAN, and DHCP reservation is a means to do this.

3. Select your Pico W from the list of attached devices.

4. Add the reservation to the IP Lease Table, then click Apply. This will guarantee that your Pico W receives the same IP address within your home.

5. Navigate to the Port Forwarding menu on your router. In our case it was under Advanced Settings >> Port Forwarding.

6. Set the service to HTTP (port 80) and create a rule for HTTP traffic. Set the start and end port to 80, protocol to TCP and set the IP address to that of your Pico W. Save then apply the rule.

7. On another device, connected via a different network (cellular) open the browser and go to your external IP address. You will now see the web page served via your Pico W.

]]> https://www.tomshardware.com/news/microsoft-confirms-windows-11-edge-default-browser 5YiWwerD9VeTSTy54VvaEn Tue, 16 Nov 2021 15:25:15 +0000 Wed, 05 Feb 2025 14:19:06 +0000 false false false

Microsoft this week confirmed to Paul Thurrott that it is forcing the Edge browser on Windows 11 users in specific scenarios (i.e., opening search results from the Start menu). Moreover, the company is taking this action even if customers have a third-party browser like Google Chrome or Mozilla Firefox set as their default browser.

“Windows openly enables applications and services on its platform, including various web browsers,” said Microsoft in a statement to Thurrott. “At the same time, Windows also offers certain end-to-end customer experiences in both Windows 10 and Windows 11, the search experience from the taskbar is one such example of an end-to-end experience that is not designed to be redirected. When we become aware of improper redirection, we issue a fix.”

Microsoft is, of course, talking about EdgeDeflector. Daniel Aleksandersen, the developer of EdgeDeflector, noticed that Windows 11 builds 22483 and 22494 Insider Preview builds blocked his app from functioning. So Aleksandersen designed EdgeDeflector to allow a Windows user’s default browser to display Start menu search results, bypassing Microsoft’s hijacking of the customer’s default browser choice.

When a customer sets Chrome, for example, as their default browser, it’s a reasonable assumption that it would be used within Windows 11 for all browser-related duties. Microsoft disagrees as it cites a disruption to the end-to-end user experience for customers with workaround apps like EdgeDeflector. However, we’d argue that if a customer has chosen to use a third-party browser, forcing Edge upon them for simple tasks is a direct contradiction of this edict.

“It’s clearly a user-hostile move that sees Windows compromise its own product usability in order to make it more difficult to use competing products,” said Aleksandersen last week. “Your web browser is probably the most important — if not the only — app you regularly use. Microsoft has made it clear that its priorities for Windows don’t align with its users’.”

Aleksandersen tells users to complain to local antitrust regulators or switch to a competing operating system like Linux to put pressure on Microsoft. However, if you want a slightly complicated workaround for Microsoft’s latest attack on default browsers, there’s a new script that allows you to maintain the status quo.

This is the latest saga in the default browser battle in Windows 11. The company caught flak recently, most vocally from Firefox developer Mozilla, for making it more difficult for users to switch their default browser.

]]> https://www.tomshardware.com/news/mozilla-firefox-microsoft-store-windows-11 57JqyyaT5Ya5m4qMVJSWGN Tue, 09 Nov 2021 17:14:47 +0000 Wed, 05 Feb 2025 14:19:05 +0000 false false false

Mozilla's Firefox browser just achieved a milestone today: It became the first "major" web browser to make its way to the Microsoft Store for both the Windows 10 and Windows 11 operating systems. Mozilla has played a sort of cat and mouse game with Microsoft in the past, particularly when it comes to default browser shenanigans in Windows 11. However, the two companies seem to have buried the hatchet with this latest move.

"Previously, if you were on Windows and wanted to use Firefox, you had to download it from the internet and go through a clunky process from Microsoft," said Mozilla in a statement. In addition, before July 2021, Microsoft prevented browsers using an independent engine from appearing in the Microsoft Store. With the July policy update, both Chromium and Gecko (Firefox's browser engine) are permitted within the Microsoft Store. Interestingly, Chromium also underpins the dominant Chrome browser, but Google has yet to bring its browser to the Microsoft Store.

"Now that Microsoft has changed its Store policies, choosing Firefox as your desktop browser is even more seamless — and it comes with all the latest Firefox features," Mozilla continued. "People deserve choice and we're glad there is an easier option to download Firefox on Windows."

Mozilla says that Windows users will now be able to easily see the benefits of Firefox and take advantage of the following features:

• Strong privacy protections with Total Cookie Protection, Enhanced Tracking Protection, and DNS over HTTPS
• Lightning fast site loading and display using WebRender and Quantum CSS
• Discovering more of the web quicker and smarter with Firefox Suggest
• Taking control of your entertainment with Multi Picture-in-Picture
• Personalizing your experience with seasonal Colorways.

Firefox's new home in the Microsoft Store comes almost two months after Mozilla reverse-engineered Microsoft's "one-click" method for setting the default browser in Windows 11. Microsoft previously only gave its homegrown Edge browser the ability to take on default status with a single click. For users with third-party browsers, it was a more cumbersome process involving navigating to Settings and changing individual file associations (i.e., HTM, HTML, PDF, SHTML, SVG, WEBP, XHT, XHTML, FTP, HTTP, and HTTPS).

"People should have the ability to simply and easily set defaults, but they don't. All operating systems should offer official developer support for default status so people can easily set their apps as default," a Mozilla spokesperson told The Verge back in September. "Since that hasn't happened on Windows 10 and 11, Firefox relies on other aspects of the Windows environment to give people an experience similar to what Windows provides to Edge when users choose Firefox to be their default browser."

You can download Firefox for Windows 10 or Windows 11 by directly visiting the Microsoft Store.

]]> https://www.tomshardware.com/news/spookyghost-comes-to-raspberry-pi LFDQXZXSBYJae3LNuM6Srf Thu, 04 Nov 2021 15:37:03 +0000 Wed, 05 Feb 2025 14:19:19 +0000 false false false

If you want to make games for the Raspberry Pi, why not make them on a Pi? SpookyGhost is an open-source animation tool created by developer Encelo that can animate sprites. According to this post recently shared to Reddit, SpookyGhost officially received a port just for the Raspberry Pi.

SpookyGhost can help artists who need to create a variety of procedural animations for 2D sprites. It provides a GUI designed with Dear ImGui, an open-source C++ library for creating interfaces to adjust pixel color, sprite size, position, and more. Users can also program custom animations using Lua scripts.

Encelo explains in the thread that all input and output are currently handled through PNG file types. The animations produced by SpookyGhost can be exported as separate files for each frame or into one sprite sheet.

The best Raspberry Pi projects are flexible, and SpookyGhost is available on a variety of platforms. You can find support for Windows, Mac, Linux, and Android on the official website. But for those who want to see the source code, you’ll have to head over to GitHub,

For more information and a peek at the questions answered by Encelo, check out the original Reddit thread and be sure to follow Encelo for future updates. 

]]> https://www.tomshardware.com/how-to/change-default-browser-windows-11 CQawvtsn2aoJNPczawJhon Sat, 21 Aug 2021 19:06:31 +0000 Wed, 05 Feb 2025 14:19:11 +0000 false false false

Microsoft really wants you to use its Edge Browser so much so that it's made changing the default browser in Windows 11 a little more difficult than in Windows 10. Instead of allowing you to simply change something called the "default browser" in the Settings menu, you now have to tweak file associations for particular link types   such as .html files, .htm files, http and https.

In addition, we found that Chrome browser was unable to change these settings for you when we clicked the button to make it our default browser, instead dropping us into the appropriate menu to do it on our own. Though strangely Firefox could perform the same task by itself.  Perhaps worst of all, though, is that even if you change the settings correctly, Microsoft will still open Edge browser if you click links that appear in Windows 11's Search function or its Widgets box. 

Fortunately, it's easy to change your default browser in Windows 11 if you just follow these simple steps.

Changing the Windows 11 Default Browser in Settings

To be fair to Microsoft, a lot of the criticism it has taken over the default browser situation in Windows 11 is due to the fact that it simply doesn't call the settings you need to change "default browser" like it does in Windows 10. Instead, it hides the settings you need under the name of the app you want to be the default (ex: Chrome, Firefox), and a couple of different file associations

To change your default browser settings in Windows 11:

1. Navigate to the Default apps settings menu. The fastest way to get there is by using Windows search to search for "Default apps" and clicking the top result. Or you can click through to Settings->Apps->Default apps.

2. Scroll down and select the browser you want to be the new default (ex: Google Chrome). 

3. Scroll down to HTTPS and click the name of the current default browser (ex: Edge). A pop-up menu will appear.

4. Select the new browser you want to be the default and click OK.

You will notice that the defaults have now changed for both HTTP and HTTPS. It seems that these are linked together. If, for some reason, this doesn't happen for you, repeat this action for HTTP as well.

5. Repeat steps 3 and 4 for .htm and .html. At this point, you could stop and your default browser would be changed for all Web URLS you click on and even for local HTML files on your hard drive / SSD, which for most people is what matters. However, you can also set your preferred browser to open PDFS or more obscure formats such as XHTML and SHTML.

Setting the Default Browser for Search and News

Sadly, like Windows 10 before it, Windows 11 does not honor your default browser choice when you click on any web links that appear in Windows Search or in the news widgets. No matter what you have chosen in the Settings->Default Apps menu, it will still open these links in Microsoft Edge. 

However, there's a freeware app called EdgeDeflector that fools Windows 11 (or 10) into redirecting these links to your default browser. Here's how to set it up.

1. Download and install EdgeDeflector. Note that, if you attempt to download this program in Edge browser, the browser will attempt to block it, claiming it is unsafe (thanks Microsoft; we're sure your motives are pure here) and you can click "keep" to make it download, but you're better off downloading in another browser anyway.

No matter how you download EdgeDeflector, Windows 11 will likely give you a warning message when you launch the installer. You will probably be confronted with a SmartScreen error saying that "Windows protected your PC" from this app (the color may be red). If so, click on the "More info" link.

And then click Run anyway. 

You can then finish the install.

2.  Navigate to the Default Apps menu.

3. Select EdgeDeflector.

4. Click Microsoft Edge under the "Micosoft-Edge" subheader.

5. Click "Switch anyway" if prompted.

6. Select EdgeDeflector and click Ok on the pop-up menu.

This should now allow links you click from Widgets or Windows Search to open in your default browser. 

]]> https://www.tomshardware.com/news/windows11-default-browser-change kRycwyVvPfYigmcBgCFuYX Wed, 18 Aug 2021 15:28:16 +0000 Wed, 05 Feb 2025 14:19:19 +0000 false false false

Microsoft has unveiled its Windows 11 operating system (OS) with plenty of new and improved features, but it feels like every time we take a few steps forward, we take one backward as well. According to a report from the Verge, Microsoft is making it harder to change your default web browser in Windows 11 OS.

Default browser choice in your OS should be a simple solution. Upon install of Windows OS, Microsoft sets the Edge browser to be your default option until you later choose anything else, usually Chrome or Firefox. And that is how it used to function before the arrival of Windows 11.

In the current Windows 10 OS, to change the default browser application you simply have to navigate to the Start Menu, type Default Apps, find the web browser drop-down menu, and select the desired default browser for all your browsing efforts. However, that is not how it functions in Windows 11.

In Windows 11, if you don't toggle the "Always use this app" box when opening links for the first time, Microsoft will simply default everything to the Edge browser. And changing that is no simple task. Unlike Windows 10, the new Windows 11 doesn't have an option to choose one browser for everything, but rather splits it by files. You have to choose the default application for opening of all files that are in HTM, HTML, PDF, SHTML, SVG, WEBP, XHT, XHTML, FTP, HTTP, and HTTPS format. That means a long process of choosing the default setting and maybe not known to many.

This process is not very friendly, especially for not tech-savvy people. Microsoft has noted that "With Windows 11, we are implementing customer feedback to customize and control defaults at a more granular level, eliminating app categories and elevating all apps to the forefront of the defaults experience," continuing that the company is constantly learning from the community and bettering the Windows 11 experience. 

Following its statement, it is pretty clear that the separation of all this change is imminent, but it would be still nicer to have a simple toggle like we see with Windows 10.

]]> https://www.tomshardware.com/news/circuitpython-powers-ti-84-calculator T23Q5q9RMRabA42MujZrrh Sun, 23 May 2021 16:49:08 +0000 Wed, 05 Feb 2025 14:19:26 +0000 false false false

Math class just got even more fun! If you're lucky enough to get your hands on the new TI-84 Plus CE Python Graphing Calculator from Texas Instruments, you now have the opportunity to tinker with CircuitPython! That’s right, it’s not just for the Raspberry Pi Pico and other microcontrollers.

In a recent blog post, Adafruit confirmed the news is official and CircuitPython is definitely coming with the new calculator. This confirmation was echoed by Texas Instruments in a follow-up Tweet.

The new development is referred to as TI-Python and it's based on CircuitPython. It functions as an interpreter for Python scripts that, according to Texas Instruments, run independently from the CE OS calculations.

Adafruit dug a little deeper and discovered a few modules that come with the new TI-Python application and verified seven ranging from random number generators to ones that integrate directly with the CE OS.

The TI-84 Plus CE Python Graphing Calculator is listed available for sale in the UK but has yet to make its way to the US—although, Adafruit managed to find a teacher with one on Twitter. In the meantime, interested parties can sign up for update notifications. Read more about the TI-84 Plus CE Python Graphing Calculator in the official PDF provided by Texas Instruments. 

]]> https://www.tomshardware.com/news/internet-explorer-killed-by-2022 uX4mbkqDaGRCc3DgQFZMwV Wed, 19 May 2021 18:46:28 +0000 Wed, 05 Feb 2025 14:17:51 +0000 false false false

Microsoft is finally kicking the curb to its once-famous and popular Internet Explorer web browser. In a recent blog post, Microsoft said that it plans to fully retire Internet Explorer 11 (the latest version of the browser) by June of 2022.  For companies still using apps tailor-made for Internet Explorer, Microsoft has added an Internet Explorer compatibility mode to Edge, to ensure critical enterprise apps remain operational.

Since the introduction of the Edge web browser in 2015, we knew Microsoft had fully planned to retire its now seriously-outdated Internet Explorer browser. Since its glory days in 2003, Internet Explorer saw a rapid loss in traction, even before Microsoft released its Edge browser.

Back in the early 2000s, Internet Explorer was actually one of the best browsers on the web and supported cutting-edge technologies that no other browser supported. But, due to Microsoft's persistent use of proprietary APIs and lack of consistent updates, Internet Explorer quickly lost ground to other web browsers like Chrome and Firefox in the early 2010s.

Now, all Internet Explorer is used for is to run proprietary applications which only work with Internet Explorer's code. This is where Microsoft's Internet Explorer compatibility mode will fully replace Internet Explorer, allowing Internet Explorer-specific applications to remain functional.

For more details, check out Microsoft's FAQ. As of this moment, Microsoft is asking all companies that still operate with Internet Explorer 11 to migrate to Edge's Internet Explorer compatibility mode as soon as possible.

]]> https://www.tomshardware.com/how-to/turn-a-rotary-phone-into-google-assistant-with-raspberry-pi Uvrjsuo6iN4P8DuhZxeYo5 Sun, 02 May 2021 12:00:48 +0000 Wed, 05 Feb 2025 14:19:28 +0000 false false false

I have some old telephones lying around - few of them fully functional anymore. I was going to throw out one of them when I realized I could replace the inner wiring with a Raspberry Pi, and have the Google Assistant running on it. 

While it’s certainly easier to call “hey google” across the room, there’s something fun about picking up the phone, asking it a question, and having it immediately respond. This is how to install the Google Assistant on an old rotary telephone with a Raspberry Pi Zero. 

What You’ll Need to make an old phone into a Google Assistant 

• A Raspberry Pi Zero with soldered GPIO pins, a memory card (with Raspberry Pi OS on it), and power adapter
• An old telephone with a functional receiver (speaker and microphone), and a functioning hook switch that you don’t mind destroying
• A few female jumper cables, wire strippers, and electrical tape or solder
• A few types of screwdrivers depending on your phone
• 1 USB audio adapter compatible with linux
• 1 male-male 3.5mm audio cable
• 1 Raspberry Pi Zero micro USB to USB A female adapter

How to Install the Google Assistant on an Old Phone 

This Raspberry Pi project is quite extensive and can take a bit of time, so I’ve split it up into four distinct parts: 

• Registering with Google
• Authenticating with Google
• Wiring your telephone
• Setting up the assistant

Registering With Google 

Before we use a Raspberry Pi as a Google Assistant, we must register the device with Google. This process can be a bit confusing if you’ve never used Google Cloud Platform before, but the steps should be easy enough to follow. 

1. Clone this repository to your raspberry pi. 

cd ~/git clone https://github.com/rydercalmdown/google_assistant_telephone

2. Navigate to https://console.actions.google.com in your browser. This site allows us to manage Google Assistant Actions, as well as register custom Google Assistant devices.

3. Click “New Project” and fill in the required information. The name doesn’t matter - just pick something you can remember. 

4. In a new tab, visit this link to Google Cloud Platform, and confirm that the name of the project you just created appears in the top bar - if not, select it. Then, click the “Enable” button to turn on the API. 

5. In your original tab, scroll to the bottom of the page and click “Are you looking for device registration? Click here” 

6. On the next page, click “Register Model”.

7. Fill in the required information and copy down the Model ID to file - you will need it later.

8. Click Download OAuth 2.0 credentials to download the credentials file your Raspberry Pi will use to make requests.  

9. Rename the downloaded file to oauth_config_credentials.json and transfer it to your pi. Place it into the repository folder you cloned in step 1. 

# Rename your downloaded filecd ~/Downloadsmv your_unique_secret_file_name.json oauth_config_credentials.json# Move the file into your repositoryscp oauth_config_credentials.json pi@your_pis_ip_address:/home/pi/google_assistant_telephone

10. Back in the browser, after downloading and renaming the credentials, click the “Next” button.

11. On the “Specify traits” tab, click “Save Traits” without adjusting any settings to complete the setup.  

Authenticating With Google 

We’ve now registered a device with Google. Next, it’s time to authenticate this device so it has access to our Google account and personalized assistant.

1. Navigate to https://console.cloud.google.com/apis/credentials/consent ensuring that the project matches the name you decided in Step 3 of “Registering With Google”. 

2. Select “External” and click the “Create” button. 

3. Fill in an App name. Once again, this doesn’t really matter - but to keep it simple I went with the same name as before.

4. Select your email from the dropdown in User support email. This is in case any users of your app need to contact you, but since we won’t be making the app public, there’s no need to worry.

5. Add that same email under “Developer contact information” and click “Save and Continue”. 

6. On the next page, click Add or Remove Scopes to bring up the scopes sidebar.

7. Search for “Google Assistant API” in the search bar, and check the /auth/assistant-sdk-prototype scope. Then click update, followed by “Save and Continue” at the bottom of the page. 

8. On the next page, click “Save and Continue” to skip Optional Info.

9. With the setup complete, click “OAuth Consent Screen” in the sidebar to refresh the page - then “Add User” under Test Users.

10. Add your Google account’s email, and click save. 

11. Next, on your pi navigate to the downloaded repository and run the following command: 

cd ~/google_assistant_telephonemake authenticate

12. Follow the link it gives you and complete the Authentication process in your browser. Once the process is complete, copy the code and paste it back in your terminal.

13. If successful, you’ll see a message indicating “credentials saved:” followed by a path to the credentials. Use this path to move the credentials into the current directory. Transfer these credentials to your repository’s root directory 

# credentials saved: /Users/test/Library/Application Support/google-oauthlib-tool/credentials.jsonmv /Users/test/Library/Application\ Support/google-oauthlib-tool/credentials.json /home/pi/google/assistant/telephone/credentials.json

Wiring Your Rotary Telephone With Raspberry Pi 

Depending on your rotary phone, this process will vary widely. These are the steps that I used, but likely this will require a fair bit of trial and error on your part. Make sure you use a phone you don’t care about, as it won’t be able to work normally after this.

1. Take the cover off the telephone. You may need to loosen a screw on the bottom. 

2. Find and strip the wires connected to the hook switch. We’ll connect these wires to the pi’s GPIO pins to determine if the receiver has been picked up or set down.

3. Connect the hook switch wires to GPIO Board pin 18 and ground. You may need to solder the wires from the hook switch to jumper wires to connect them easier, or just attach them together with a bit of electrical tape. 

4. Connect your USB audio adapter to the raspberry pi zero. You will need a USB-micro to female USB-A adapter to do this.

5. Solder the microphone and speaker in the handset to two separate 3.5mm cables. These will carry the signal from the pi to the speaker, and from the microphone to the pi. You should be able to connect these within the phone case and use the original handset cord. This will take a bit of trial and error to determine which wires belong to the speaker, and which to the microphone. 

6. Connect the 3.5mm cables to the USB audio adapter being mindful to connect them in the proper order. 

7. Tuck the pi into the phone, and close up the cover - or keep it open while you debug setting up the assistant. Run the power adapter connected to the pi out the back of the case where the original telephone wire would go. 

Setting Up The Assistant 

1.  Run the installation script. It’ll take care of base and python requirements. If you have a Raspberry Pi Zero, the compilation process can take hours and will appear stuck on a step installing grpc (it just moves very slowly). I’d recommend leaving it running over night. 

cd google_assistant_telephonemake install

2. Configure your USB audio by running the following command. It will take care of editing your alsamixer config, setting your USB card as your default audio output, and setting volumes for the speaker and microphone. 

make configure-audio

3. Test and adjust your volumes by running the following command, speaking, and listening through your phone’s handset. If your volume is not high enough on your microphone or speaker, set it with the alsamixer command. 

# Run, speak something into the microphone, and listenmake test# Set volumesalsamixer

4. Export your project ID to an environment variable. You can retrieve your project ID by visiting this URL, selecting your project, clicking the three dots next to your profile photo in the top right, and clicking “Project Settings” 

export PROJECT_ID=your-project-id

5. Export your model ID from the Registering With Google steps to an environment variable. 

export DEVICE_MODEL_ID=your-model-id-from-the-earlier-steps

6. Run the make run command. It will take care of registering this device, and saving the configuration to disk so you won’t need the environment variables in the future. 

make run

7. Test your assistant by picking up the phone, and asking it a simple question, like “What is the capital of Canada?” If all goes well, you’ll see some logs in the terminal, and the assistant will respond. To ask another question, hang up the receiver and pick it up again.

8. Finally, run the following command to configure the assistant to run on boot. 

make configure-on-boot

]]> https://www.tomshardware.com/news/xcsset-malware-targets-m1-macs-xcode AeW8XRDicwxm98ooCq4ALJ Tue, 20 Apr 2021 13:58:04 +0000 Wed, 05 Feb 2025 14:19:08 +0000 false false false

Researchers have discovered that the XCSSET malware has started targeting M1-equipped Macs via Xcode, The Hacker News reported Monday and has been updated to compromise accounts on various cryptocurrency trading platforms.

Xcode is the integrated development environment (IDE) used to make apps for the iPhone, iPad, and other Apple hardware. Even if a cross-platform framework is used to develop a particular app, it must pass through Xcode to reach those platforms.

That means XCCSET is limiting itself to technically savvy people who, if we had to guess, would be more likely to own cryptocurrency than the average Mac owner. Targeted attacks like this are often more successful than broader ones.

Kaspersky warned that XCSSET had been updated for Apple's custom silicon in March. The malware wasn't focused on cryptocurrency at the time, the security company said. Instead, it featured a variety of modules that were designed to:

• Reading and dumping Safari cookies
• Injecting malicious JavaScript code into various websites
• Stealing user files and information from applications, such as Notes, WeChat, Skype, Telegram, etc.
• Encrypting user files

Trend Micro then warned on April 16 that XCSSET had been updated to bypass security features introduced with macOS Big Sur, change the icons it uses to match system icons, and attempt to gain access to victims' accounts on crypto platforms.

The company's advice was clear: "To protect systems from this type of threat, users should only download apps from official and legitimate marketplaces," it said. But that's hard to do when it comes to finding Xcode projects to work with or learn from.

XCSSET's expansion to cryptocurrency makes sense. The value of Bitcoin, Ethereum, and even Dogecoin has continued to rise in recent months, and stealing coins from someone else is probably requires fewer resources than mining them would.

Adding support for Apple's custom silicon was also prudent. Devices featuring the M1 chip have been well-reviewed, and with Apple's plan to ditch Intel entirely by the end of 2022, it makes sense to start targeting its chips now.

Other malware creators appear to agree. We saw reports of the first malware targeting Apple silicon in February, and in March, the Silver Sparrow malware was discovered on approximately 30,000 macOS devices, some of which had M1 chips.

]]> https://www.tomshardware.com/news/raspberry-pi-uv-mask-sanitizer nptcwuiFueGsatGdcZpnq5 Mon, 12 Apr 2021 13:59:13 +0000 Wed, 05 Feb 2025 14:19:21 +0000 false false false

Bringing home a used face mask can harbor unseen and unwanted bacteria. But we've noticed something over the years—where there's a problem, there's a Raspberry Pi solution! Today's project tackles this issue and is known as the Box of Hope, developed by Jan-Hendrik Ewers, Sarah Swinton, and Martin Karel.

The best Raspberry Pi projects help make life easier, and this project takes a lot of guesswork out of mask sanitization. The Box of Hope has a sanitizing chamber that utilizes UV LEDs to sterilize fabric face masks. It also relies on wireless technology to issue daily usage reminders.

According to the dev team, the project was designed to be a box kept at the user's home. It's connected to the internet, which is necessary to send sanitization reminders to a given mobile device.

There are three major components in the project design: an API, a web app, and an I/O server. The RESTful API manages HTTP requests between the client and server. The I/O server runs on the Pi while the web app manages notifications.

If you want to read more about this project, visit the official Box of Hope website and project GitHub page.

]]> https://www.tomshardware.com/news/raspberry-pi-matrix-browser-painting-app yvAgJh3bM4wgwnfqFKQ9g4 Thu, 01 Apr 2021 21:30:00 +0000 Wed, 05 Feb 2025 14:19:31 +0000 false false false

Customizing a matrix with a Raspberry Pi can be tricky, but Neythen Treloar's project changes that by making it possible to paint an image onto a matrix in real-time from any browser. This isn't the first time we've shared Neythen's work, we previously showcased his matrix-based video game project.

The new project is dubbed Pixel Paint and it's completely open-source for the community to use—the best Raspberry Pi projects usually are.

The code for this application was written using three languages: Javascript, C++ and Python. A Django backend server is used to operate the web app and bridge the communication between the matrix LEDs and browser input.

According to Neythen, the project was tested and proved to work with a Raspberry Pi 4, Raspberry 3 A and even a Pi Zero (albeit with some latency). There are plans in the works to upgrade the project with text input support.

In the meantime, you can check out the source code on GitHub and read more about this project in detail on the original thread from Reddit. 

]]> https://www.tomshardware.com/news/google-publishes-spectre-javascript-proof-of-concept cpakT43DfHfnjUmHkxBBBD Mon, 15 Mar 2021 14:07:35 +0000 Thu, 21 Aug 2025 08:56:50 +0000 false false false

Spectre continues to go bump in the night. The vulnerability was revealed in 2018, but even though it's largely faded from public consciousness, it's still a threat. Case in point: Google has published a proof-of-concept website called Leaky.Page that shows how attackers can use JavaScript to exploit Spectre via popular web browsers.

Let's turn back the clock. Spectre was disclosed with another vulnerability, Meltdown, that vendors were quick to address despite their fixes causing slight performance drops. Responding to Spectre has proven more difficult because it requires Intel, AMD, Arm, and Nvidia to change their processor architectures.

In the meantime, it's up to other companies to limit their customers' exposure to the vulnerability, which is where this proof-of-concept comes in. Google said in a blog post that it wanted to "give web application owners a better understanding of the impact Spectre vulnerabilities can have on the security of their users' data."

The result is Leaky.Page, which offers a summary of Google's intent before giving people the chance to see how JavaScript-based Spectre exploits could affect their systems. Google published a video of a successful test that you can watch right here:

Leaky.Page was originally configured for Chrome 88 running on an unidentified version of Linux and an Intel Core i7-6500U. Google said that its proof-of-concept could "function across a variety of operating systems, processor architectures, and hardware generations," however, "without any major changes" to the code.

The company only named one additional processor susceptible to this exploit: the M1 chip Apple introduced in November 2020. That doesn't come as a surprise—we already knew that Arm's designs were affected by Spectre—but it's a worthwhile reminder that Apple silicon can be affected by three-year-old vulnerabilities.

Google said its tests on Chrome 88, Linux, and an Intel Skylake processor leaked data at speeds up to 1kB/s. Results will vary based on the system tested, however, which is why Leaky.Page could prove useful. A list of recommendations to web developers looking to protect their users can be found in Google's blog post.

Even they aren't enough. Google noted that "while all of the mechanisms described in this article are important and powerful security primitives, they don't guarantee complete protection against Spectre; they require a considered deployment approach which takes behaviors specific to the given application into account."

]]> https://www.tomshardware.com/news/raspberry-pi-pico-piper-make XosVvrj4NHxT8yuLPgjffC Mon, 15 Mar 2021 12:47:24 +0000 Wed, 05 Feb 2025 14:19:31 +0000 false false false

It may not be the first block-based language for the Raspberry Pi Pico, but Piper Make definitely takes the crown of the best looking. Released yesterday, Piper Make is the latest project from Piper Learning, which previously created the Piper Computer Kit. Piper Make comes as a free online service or as part of a monthly subscription service.

IT'S HERE: Piper Make, available now in your browser on Mac, PCs, and @Google Chromebooks! Start inventing with the new @Raspberry_Pi Pico using our drag-and-drop coding platform! 🧑‍💻🥧Try it out at https://t.co/8wHaBMGg0T!#WhatWillYouCreate #STEMeducation #RaspberryPiDay pic.twitter.com/rm0Bi0dN1RMarch 14, 2021

Piper Make is a browser-based editor and scheme of lessons designed to introduce MicroPython via the Raspberry Pi Pico. The user interface is clearly designed for younger makers, with bright colors and large icons, but underneath all of this is a decent selection of lessons that introduce coding concepts and electronics via challenges and projects.

We went through the getting started process, first by flashing a custom firmware to our Raspberry Pi Pico and then following the first lesson to get a feel for the workflow. The block interface is extremely easy to use and automatically handles importing the libraries necessary for the blocks on offer.

Certain blocks, such as those found in Sensing, require extra components. For example, the temperature sensor block requires an I2C temperature sensor to be attached. You can purchase these sensors separately, but for a one-off payment of $30, you can purchase a starter kit with a Raspberry Pi Pico and basic components to get you started. The monthly subscription option is $20 and each month a new component is delivered to your door along with new Piper products.  

Despite this being a block-based coding platform, Piper Make is really Python. Via the Python tab on the bottom of the screen, we can switch to a view-only mode and see the project's code, which is useful for coders transitioning from blocks to text. 

Piper Make is an impressive way to introduce coding, and the monthly subscription model usefully provides curated components and lessons to support your learning. 

]]> https://www.tomshardware.com/news/raspberry-pi-solar-panel-monitor p29P5uX3Z37SRsCgvEPqZW Tue, 13 Oct 2020 07:06:23 +0000 Wed, 05 Feb 2025 14:19:22 +0000 false false false

Your power bill can easily become one of your biggest monthly expenses. This project, created by BeepBoopWhat on Reddit, helps tackle that problem by using a Raspberry Pi to monitor solar panels and calculate their expected monthly impact on the power bill.

The project features a 3.5" LCD display panel which reads out pertinent information about power usage in real-time. The data collected comes from Envoy brand solar panels. A cycle completes every 20 seconds, calculating the expected cost or income based on tariff information provided by the power company.

The project relies on two custom scripts. One is used to pull data from the solar panels and inject it into a sqlite3 database. The other script is used to compile the data for visual output on the LCD screen by means of a custom HTML page.

If you want to read more about this project,  you can check out the code on GitHub and maybe even recreate it yourself.

The original thread provides a few more details with nuance for Envoy solar panel users and information on how to integrate them into Pi projects. Be sure to follow BeepBoopWhat for more updates and future Pi projects.

]]> https://www.tomshardware.com/news/will-this-speed-up-your-raspberry-pi-browsing-by-up-to-1200 5W3uP6kgdtAg9xatefBchK Mon, 10 Aug 2020 17:47:40 +0000 Wed, 05 Feb 2025 14:19:05 +0000 false false false

One of the inevitable consequences of the pandemic is that schools and educational facilities have closed their doors to keep students safe. There has been a shift towards distance learning via video and e-learning platforms. Puffin Cloud Learning, a Raspberry Pi OS based operating system from CloudMosa is looking to speed up your e-learning with the Raspberry Pi. In a bold claim on their website “Browser benchmarks suggest Puffin is 1,200% faster than Chrome on Raspberry Pi.”

Puffin manages these incredible speeds because the content is rendered remotely on their encrypted cloud servers. A JavaScript engine is used to pre-process and compress web pages before they arrive at your screen. This can be interpreted as a proxy server by some sites, and may affect the content that is available to you. 

Puffin Cloud Learning is claimed to be “300% faster than Chrome OS devices costing 300% more” and a Raspberry Pi is seen to be a cost effective solution for schools. “Raspberry Pi seems to be the best, if not the only, financially viable solution for many schools. For the cost of a $350 PC, the school can have 10 bare-bone Raspberry Pi.”

We installed the Puffin Internet Terminal, the same browser that powers Puffin Cloud Learning on a Raspberry Pi 4 and in a speed test, loading the Tom’s Hardware site, we didn’t see a massive difference in speed. Puffin Internet Terminal was slightly faster at rendering the page but nowhere near the 1200% benchmarks suggest. That being said, every second counts and the browser feels responsive for general use.

As spotted by leepspvideo, Puffin Cloud Learning / Puffin Internet Terminal is an interesting solution to speeding up your browsing.

]]> https://www.tomshardware.com/news/smartipresence-an-affordable-accessible-telepresence-robot reCTK8BV5cfoxnQhxjyvKg Tue, 28 Jul 2020 11:24:51 +0000 Thu, 30 Jan 2025 16:42:05 +0000 false false false

Telepresence robots, such as those used by Dr Sheldon Cooper in The Big Bang Theory are expensive and difficult to build. Altrubots and The Crafty Robot today launched their own desktop telepresence robot via Kickstarter with pledges starting from $62 (£50).

Smartipresence is a cardboard chassis robot that uses rubber bands and screws for a simple yet robust construction. Place your smartphone into the articulated holder and then connect it to the Smartibot NRF 52 series ARM Cortex-M4F control board via Bluetooth. Remote control is achieved by sending a “pilot link” to another device and then we can stream video from the pilot device, to the Smartipresence. Control is achieved using on screen buttons, we can move the robot in any direction and control the angle of the arm. 

Writing code for the robot is made possible thanks to a version of JavaScript for microcontrollers called Espruino. Younger coders can learn to control the robot using a block based language, while seasoned coders can get to  grips with JavaScript directly. Both methods are via a web browser, enabling quick and easy access no matter what device we are using.

UK readers may be familiar with Ross Atkin, a researcher, designer and engineer, who featured in BBC’s “The Big Life Fix” where inventors and engineers developed life changing solutions for people in desperate need. “It’s awful not being able to visit loved ones right now and I wanted to make something to help” explained Ross Atkin. “I thought telepresence might be useful, but not the robots designed for corporate environments that cost thousands. I realized that the Smartibot kit already had most of the parts you’d need to make a really accessible telepresence robot that would work in people’s homes. So I designed the extra cardboard parts to make the experience as good as it could be, and worked with Altrubots to put together the software. It’s turned out great. It’s not quite as good as actually being somewhere but it’s a whole lot better than a video call.”

The kit contains everything needed to create your own telepresence robot, including DC motors so all we need to add is a spare smartphone. You can pick up your own robot directly from their page on Kickstarter.

]]> https://www.tomshardware.com/how-to/run-script-at-boot-raspberry-pi xfL9uALuQzRnCZw2eSFsNK Sat, 04 Jul 2020 12:00:52 +0000 Wed, 05 Feb 2025 14:19:31 +0000 false false false

There are a lot of reasons you’d want to run a Python script, an app or another type of script (ex: a Bash script) every time your Raspberry Pi boots up. Perhaps you have a robot or IoT device that has to be ready to perform a task as soon as the Raspberry Pi powering it starts up. Or maybe you just want to have a particular program running in the background at all times and don’t want to have to launch it manually at every session.

There are a number of ways to automatically start a script at Raspberry Pi bootup, but the easiest is to use crontab, a scheduling feature that also lets you set scripts to run at particular times.

How to Run a Script at Raspberry Pi Boot

1. Edit your crontab list by typing:

sudo crontab -e

You can launch crontab without entering sudo, but if you do, you won’t be able to run scripts that require admin privileges. In fact, you get a different list of crontabs if you don’t use sudo so don’t forget to keep using it or not using it.

2. Select nano if you are prompted to ask for an editor.

A file opens.

3. Add a line at the end of the file that reads like this:

@reboot python3 /home/pi/myscript.py

The line has to begin with @reboot which tells it to run every time you boot the Raspberry Pi. If it’s a Python script, you’ll want to put the command to launch the python or python3 interpreter followed by the full path to your Python script. 

If it is a Bash script or another app, just put the full path to it.

4. Save and exit. In nano, you do that by hitting CTRL + X, answering Y and hitting Enter when prompted.

5. Make your script executable if it is a Bash script. Python scripts won’t need to be executable because the python interpreter already is. You can make any script executable by typing 

sudo chmod a+x FILENAME

If you want to remove your script from the crontab, simply type sudo crontab -e again and remove or comment out that line. Note that, if you are building a project that doesn’t require you to use the windowed environment, you can save system resources by configuring the Raspberry Pi to boot to the command line by entering sudo raspi-config and then navigating to Boot Options -> Desktop / CLI and selecting Console Autologin.

How to Autorun a Script or App in the Raspberry Pi GUI

If you want to have your script or app run at Raspberry Pi startup within the windowed GUI, follow these steps.

1. Create a file called myapp.desktop (or something else .desktop) in the /etc/xdg/autostart/ directory.

sudo nano /etc/xdg/autostart/myapp.desktop

2. Use the following layout in the myapp.desktop file. 

[Desktop Entry]Exec=chromium-browser https://www.tomshardware.com

Put the command and any parameters on the Exec= line. For example, for a Chrome browser to open to a web page, you’d put “chromium-browser [URL].” If your app requires sudo permissions, you can put sudo in the Exec command. 

To run a script in a terminal window, use lxterminal followed by the --command parameter and double quotes with “/bin/bash -c ‘MYCOMMANDS HERE; /bin/bash”’. For example, to launch a python3 script that requires sudo permissions, you’d use: 

Exec=lxterminal --command”/bin/bash -c ‘sudo python3 /home/pi/myscript.py; /bin/bash’”

That will launch a terminal window in the windowed environment upon boot with your script running in it. Once the script finishes (or you abort it by hitting CTRL+C), you the terminal window will return to the prompt. If you want the terminal window to close itself upon completion of the script, you can leave out the ;/bin/bash at the end.

Running a script in a terminal window like this can be helpful, because if it’s a Python script on endless loop (such as you’d have for a robot), you can easily kill the script by hitting CTRL+C. Otherwise, to kill the script, you’d need to find the process, which we describe below.

Killing the Script

What if you want to stop your autorunning script after your Raspberry Pi has booted? If your script has already completed running, it will be gone from memory but if it’s designed to do something continuously, you’ll need to search for and kill the task.

1. Search for your script by using the ps aux command and putting the name of your script (or at least a partial name) after grep.

ps aux | grep app.py

Replace app.py with the name of your script. You will see a list of process numbers.

2. Kill each process number using the sudo kill -9 command. For example,

sudo kill -9 437sudo kill -9 438

More Tutorials:

• How to Capture Screenshots on Raspberry Pi
• How to Set Up a Raspberry Pi Web Server
• How to Run Raspberry Pi 4 or 3 Off an SSD or Flash Drive
• How to Create Custom Keyboard Shortcuts on the Raspberry Pi
• How to Run Emulators on the Raspberry Pi 4
• 25+ Linux Commands Raspberry Pi Users Need to Know
• How to Make a News Ticker Shirt With Raspberry Pi

]]> https://www.tomshardware.com/how-to/raspberry-pi-vs-code JoMKf6d2WsmQmZ8ySftVuM Wed, 10 Jun 2020 22:22:45 +0000 Wed, 05 Feb 2025 14:19:17 +0000 false false false

Remotely editing code on a Raspberry Pi is possible, but it relies on taking a few steps to setup the working environment. Typically we would enable SSH and then connect using a terminal, access the files on the Pi via a sftp connection or run a VNC connection after doing a headless Raspberry Pi setup. However all of these methods have their drawbacks, whether it’s limiting yourself to text-based editors in the terminal or slowing yourself down by having to constantly reupload files or wait for a sluggish remote desktop. 

But what if we could write code, on our Raspberry Pi using a web-based interface that’s accessible from another device on your network such as a laptop or tablet? Well now we can and in this tutorial we will introduce code-server, a tool that enables us to program in in Microsoft’s Visual Studio Code application from the comfort of your device’s browser. Of course, since this is a Raspberry Pi, you’ll be using Pi-friendly languages such as Python or web-friendly languages like JavaScript, not Microsoft languages such as Visual Basic or C#. 

To install code-server, power up your Raspberry Pi 4 and follow these instructions.

1. Download and install code-server by entering this command in the terminal.  

curl -fsSL https://code-server.dev/install.sh | sh

2. Autostart code-server on boot by running the server as a service in the background.

systemctl --user enable --now code-server

3. Open the config file for editing in Geany. 

geany /home/pi/.config/code-server/config.yaml

4. Change the bind address to enable any device on the network to connect. 

0.0.0.0:8080

5. Change the password to raspberry. Press CTRL + X, Y and then Enter to save and exit.

6. Get your IP address by hovering the mouse cursor over the Networking icon in the top right corner.

7. Reboot the Raspberry Pi and 

8. On a PC on the same network, open a browser and go to the IP address of the Raspberry Pi, followed by :8080. For example

192.168.0.6:8080

9. Log in using the password “raspberry.” 

10. Click on Python, found under Tools and languages to install support for Python 3.

What makes code-server and VS Code different to other more beginner focussed editors is in how they can be extended to match the way we work.

Project files can be grouped into folders, tidying away the many files that are generated in a large project.

There are tools to work with source control, where code is stored in a version control system such as Git. We can publicly publish our project while still inside the editor.

We can step through the code, looking for bugs and issues in the code as they happen. Pause, rewind, restart or stop as the code performs each task.

]]> https://www.tomshardware.com/news/raspberry-pi-project-4-plasma-bigscreen-smart-tv ibA2c7u4seRUfHEGejESCo Fri, 27 Mar 2020 17:21:46 +0000 Wed, 05 Feb 2025 14:19:15 +0000 false false false

With many people stuck at home, the desire for an at-home media center is greater than ever. But what if you could add an open-source user interface (UI), or ditch the one built into your TV, with the help of Raspberry Pi? With Plasma Bigscreen, a new AI voice and KDE open-source development released this week, it's possible to use your Raspberry Pi 4 as a center of your media hub. 

"Plasma Bigscreen powers the interface on a single-board computer and uses the Mycroft AI voice assistant to provide a smart TV platform," it says on KDE.org. "Plasma Bigscreen will deliver not only media-rich applications, but also traditional desktop applications redesigned to fit the Bigscreen experience.

Plasma Bigscreen is described as a free open-source UI experience for big-screen TVs. The Pi version is still in its  beta stage, so expect a few bugs as well as improvements along the way. The UI is catered specifically to a TV experience—it even supports remote control operation. To make things a little more modern, you can also use voice controls to navigate.

The Plasma Bigscreen image is easily flashed onto a microSD card like most other Pi operating systems. It uses Wi-Fi to update and download content for streaming. 

Plasma Bigscreen also supports major streaming apps, which the OS calls "skills." This includes YouTube and Netflix. In addition to streaming, it can play a variety of compatible games and even functions as a web browser.

If you're interested in checking out Plasma Bigscreen, now is a good time. As of this week, you can download the beta image and flash it to a fresh SD card for your Pi 4. For more details and updates on Plasma Bigscreen, check out the project's official website. 

]]> https://www.tomshardware.com/news/intel-lvi-vulnerability-mitigation-hurt-xeons-performance 5WHPvzJty9LEcgUEfgJjp7 Tue, 17 Mar 2020 11:44:54 +0000 Thu, 21 Aug 2025 08:42:09 +0000 false false false

Leading Linux publication Phoronix has investigated the performance impact of mitigating the latest Load Value Injection (LVI) vulnerability on Intel processors. 

Load Value Injection, which carries the CVE-2020-0551 identifier, allows the attacker to steal sensitive information from the victim by penetrating Intel's Software Guard Extensions (SGX). SGX essentially acts as a vault for storing important data. Both Intel and the researchers who exposed LVI have tagged the vulnerability as a theoretical threat, meaning that it's very unlikely that a malicious attacker will exploit it. Either way, Intel has released updates to the SGX Platform Software (PSW) and SDK to mitigate the security flaw.

Phoronix notes that Intel has basically added LFENCE walls before susceptible instructions. Therefore, the publication evaluated the processor's performance in five different scenarios: without Intel's mitigations, loading LFENCE before indirect branches, before RET instructions, after loads, and with all three options in tandem.

Phoronix tested the repercussions of the mitigations extensively in a real-word scenario with a Xeon E3-1275 v6 (Kaby Lake) processor. The publication's results show that enabling LFENCE before direct branches or before RET instructions has minimum impact on performance. The performance loss is less than 10%.

On the other hand, implementing LFENCE after every load instruction or all three assembler options can really cripple a processor's performance. The performance toll increases as much as 77%.

Luckily, LVI shouldn't be a big issue for consumer users since it's not common to see SGX usage on a mainstream PC. Theoretically, attackers can pull LVI off with JavaScript, however, the task is very complex. On the contrary, enterprise users should be more worried due to the frequent usage of SGX and virtualization. 

For now, Phoronix considers the mitigations necessary for users that constantly interact with SGX or highly security-sensitive applications. Nonetheless, Bitdefender states that LVI could be a stepping stone for future attacks, so enterprise users might have to eventually implement the measures and take the performance hit.

According to Intel's list of LVI affected processors, the more recent offerings, including Cascade Lake and certain steppings of Coffee Lake and Comet Lake, are only partially affected, while Ice Lake is protected against LVI.

]]> https://www.tomshardware.com/news/load-value-injection-vulnerability-found-in-intel-chips KShE6fwUzKAQB4N7s9atG5 Tue, 10 Mar 2020 17:26:51 +0000 Thu, 21 Aug 2025 09:53:22 +0000 false false false

Intel's chips have faced an onslaught of new vulnerabilities discovered by crafty researchers, and today finds the company facing yet another new flaw, Load Value Injection (LVI), that a press release from Bitdefender describes as "particularly devastating" for servers in the data center. LVI impacts all Core families spanning from the third-generation Ivy Bridge chips to the 10th-generation Comet Lake processors.

According to statements from the researchers to ZDNet, the attack builds upon the Meltdown vulnerabilities that Intel already patched in software, but the LVI still works on systems with the requisite software fixes. As such, Intel will reportedly need to employ hardware fixes to fully block the LVI attack vector. 

According to experimental fixes employed by the researchers, performance reductions from potential mitigations could vary from 2x to 19x based upon workload, but that could be offset with hardware-based fixes in new silicon. 

Here is a quick breakdown (video):

Notably, the vulnerability (CVE-2020-0551) is said to "allow attackers to inject rogue values into certain microarchitectural structures, which are then used by the victim, which may lead to revealing secrets." This allows for data theft, but can purportedly reveal encryption or passwords kept in memory, which could then allow an attacker to assume control of the target machine.

The researchers contend the attack, which requires slipping data into the SGX Enclave, could theoretically be executed via JavaScript. That means physical access to the machine isn't required, but the researchers haven't tested that attack vector yet. For multi-tenant environments, like those found in cloud-based instances, the attack could allow eavesdropping on neighboring instances. However, the researchers also note that the vulnerability is extremely hard to exploit, meaning it isn't an imminent threat to the majority of users. 

Intel has published a full analysis of the LVI flaw, stating that "Due to the numerous, complex requirements that must be satisfied to implement the LVI method successfully, LVI is not a practical exploit in real-world environments where the OS and VMM are trusted[..] Accordingly, system administrators and application developers should carefully consider the particular threat model applicable to their systems when deciding whether and where to mitigate LVI."

The flaw was discovered by Bitdefender and verified by a team of researchers that have exposed major flaws in Intel, AMD, ARM, and IBM architectures in the past. Bitdefender then created a synthetic proof of concept that it posted to GitHub. The researchers were funded by Intel, AMD, and ARM.

Bitdefender claims it shared the attack with Intel on Feb 10, 2020. The company also claims that existing mitigations for Meltdown, Spectre, and MDS are insufficient for mitigating the new flaw and that a full fix currently requires disabling hyper-threading or purchasing new hardware with in-silicon fixes. For now, that consists of the Ice Lake family and Atom processors that don't fall into the Silvermont and Airmont families. 

Intel provided us with the following statements regarding the LV1 vulnerabilities:

Load Value Injection Statement: “Researchers have identified a new mechanism referred to as Load Value Injection (LVI). Due to the numerous complex requirements that must be satisfied to successfully carry out, Intel does not believe LVI is a practical method in real world environments where the OS and VMM are trusted. New mitigation guidance and tools for LVI are available now and work in conjunction with previously released mitigations to substantively reduce the overall attack surface. We thank the researchers who worked with us, and our industry partners for their contributions on the coordinated disclosure of this issue.” 

 Statement Specific to SGX: “To mitigate the potential exploits of Load Value Injection (LVI) on platforms and applications utilizing Intel SGX, Intel is releasing updates to the SGX Platform Software and SDK starting today. The Intel SGX SDK includes guidance on how to mitigate LVI for Intel SGX application developers. Intel has likewise worked with our industry partners to make application compiler options available and will conduct an SGX TCB Recovery. Refer to the Intel SGX Attestation Technical Details for more information.”

]]> https://www.tomshardware.com/news/intel-releases-bare-metal-oneapi-level-zero-specification L9r7NmmCL48sKFvPBKs8RG Sun, 08 Dec 2019 16:11:19 +0000 Thu, 21 Aug 2025 09:53:44 +0000 false false false

Intel has released the oneAPI Level-Zero Interface specification. Giving bare-metal access to accelerators, it complements the API-based and direct programming models of oneAPI, Intel’s open programming model for heterogeneous systems that launched in November.

oneAPI: No Transistor Left Behind

oneAPI is Intel’s ambitious initiative for a unified programming model for performance-driven, cross-architecture applications. It provides code reuse and aims to eliminate the complexity of separate code bases and multiple tools and workflows. Its beta was released to the public at Intel’s HPC DevCon in November. It will also power the Aurora exascale supercomputer.

oneAPI is based on industry standards and open specifications, and consists of both the industry initiative and an Intel implementation of oneAPI. The industry initiative – open to all hardware vendors – specifies both a direct programming language, Data Parallel C++ based on C++ and the SYCL cross-platform abstraction layer, as well as API-based programming for accelerating domain-focused functions. Many parts of it are open source. For example, software developer Codeplay has already announced it is working on Nvidia GPU support for oneAPI.

The Intel product adds a compatibility tool (such as for CUDA), Intel’s distribution of Python, an FPGA add-on and analysis and debug tools. It currently supports Intel CPUs (Core, Xeon and Atom), Intel’s integrated graphics and Arria FPGAs.

oneAPI Level Zero

Underlying those direct and API library programming models is also a low-level, direct-to-metal interface to accelerator hardware that was released this week, according to Phoronix: oneAPI Level Zero. 

The Level-Zero API serves a dual purpose. While it gives fine-grain access to multiple low-level functions, most applications won’t require such explicit control. However, the Level-Zero API also provides that control to the higher-level runtime APIs and libraries.

Intel admits the Level-Zero APIs are influenced by other low-level APIs such as OpenCL and GPU architecture, but differ because they are designed to “evolve independently” and to support different compute device architectures such as FPGAs and deep learning accelerators.

Intel says the interface can be published at a cadence that matches its own hardware releases while also providing more language functions: “It can be adapted to support broader set of languages features, such as function pointers, virtual functions, unified memory, and I/O capabilities,” according to the specification overview. 

A comprehensive list of its functionality includes:

• Device Discovery
• Memory Allocation
• Peer-to-Peer Communication
• Inter-Process Sharing
• Kernel Submission
• Asynchronous Execution and Scheduling
• Synchronization Primitives
• Metrics Reporting
• System Management Interface

]]> https://www.tomshardware.com/reviews/kano-star-wars-the-force-coding-kit QfF9DGt2KPBusKisfQwL5F Tue, 26 Nov 2019 16:23:28 +0000 Thu, 26 Mar 2026 15:31:39 +0000 false false false

The Kano: Star Wars The Force Coding Kit ($79.99, ages 6 and older) comes with a motion sensor controller kids build themselves that gives them control over a JavaScript animation in the accompanying app for iPad, Windows/macOS PC or Amazon Fire. Block coding tutorials teach you to use the Force Kit’s sensors to do things like control Lightsaber movement or Stormtroopers seen in on-screen animations  by moving your hands across the motion sensor. 

By combining STEM, Star Wars (there’s also a Frozen 2 version available), colorful, playful tutorials and a small number of RGB lights, Kano has enough to get kids interested in block coding. But unlike the best STEM toys, without a lot of instructions on how to make the most with the app-specific block code or the ability to graduate to JavaScript (or any real-life programming language), your child may move on from this toy before you’d like.

 Kano: Star Wars The Force Coding Kit Specs 

Sensors	4x motion
Lighting	9x RGB LEDs
Connectivity	Bluetooth 4.2
Batteries	2x AA (included)
Compatibility:	Windows: 10, S mode (1703 Creator’s Update or newer)
	iPad: iOS 12 or iPadOS
	Mac: macOS 10.13 or later
	Amazon Fire: Fire OS 5.6.2.0. or higher
Dimensions (HxWxL)	1.1 x 3.8 x 3.8 inches (27.9 x 96.5 x 96.5mm)
Weight	0.3 pounds (0.1kg)
Warranty	1 year
Price	$79.99 / £79.99

Design and Building

When you open up the box, you’re met with some parts for building what Kano calls the Force Kit. But don’t worry about getting your kid a toolkit; this is more like snapping things together. But considering this is for kids as young as six years old, it’s appropriate. Meanwhile, slightly older kids can take greater heed of the instructions provided in the print-out manual. They teach the child that the printed-circuit board (PCB) is comprised of sensors, microprocessors, LED lights, resistors (see resistor color codes) and tracers. But besides the sensors, neither the manual nor the app tells you what any of those things are or how they work.

What you do learn about are the PCB’s four motion sensors. The included manual explains that each sensor has two “lenses” atop one another, with the top one sending out an infrared beam “a type of light invisible to humans.” When a hand interrupts the beam, the beam’s reflected down to the bottom lens, and this is how the controller knows where your hand is moving. With this motion detection, the controller is used to influence animations coded in the kit’s accompanying app.

For example, you can program a Lightsaber in the app to move left and right as your hand slides that way across the controller. Or you can make virtual Stormtroopers go flying backwards when you make a pushing motion with your hand across the Force Kit. Since the motion sensors are the core of the Force Kit, the manual’s details do provide kits with a big picture idea of how things work.

Occasionally I found the sensors finicky. Perhaps it’s because my hands are larger than that of the intended user. But sometimes the sensors couldn’t keep up with me, such as when I tried swiping a lightsaber left and right. However, moving my hand slower seemed to help.

After you learn about the PCB and add the included AA batteries into its back compartment, you snap it into the plastic black bottom case. The red power button, with Aurebesh language inscriptions, is supposed to fit “snug” on a knob sticking out of the PCB’s side, but mine was wobbly (you always have the power button face you, so the app knows which direction you’re facing). Similarly, a plastic “light ring” is supposed to fit into place on top of the PCB, but mine didn’t snap in securely until I added the plastic top case ring.

After you snap the plastic top case ring, you get to pick an icon representing your side, either Empire or Rebel, that snaps into the PCB with four pegs. When it’s finally completed, the motion controller Iooks simple, yet interesting. I appreciate the sci-fi vibe the exposed PCB brings, but with this in children’s hands, it does make it slightly more susceptible to damage.

There are eight LED lights on the PCB that shine evenly throughout the frosted white light ring, which acts as a light diffuser, plus one more LED in the center that illuminates the Empire or Rebel badge selected. But unless the lights are set to the color white, where there white-colored light ring and badge enhance a prismatic effect, they look like nine individual spots of light dulled by a white overcast.

The LED lights on my unit also had trouble producing some colors. Setting the lights to the browns available in the app’s 209-color palette resulted in the lights either looking red or off. The lights also looked off when I tried setting the lights to black or gray.

Ultimately, the Force Kit is very quick to build and, therefore, take apart and rebuild. And your child should even learn a thing or two along the way.

I appreciated the toy’s printed-out manual. Cuter versions of Star Wars characters sprinkle the pages, and it conveys directions in a digestible manner, with one page per direction featuring one large picture and short sentences.

The manual also advises you to visit help.kano.me for support and provides troubleshooting codes to enter for the motion sensor controller not powering up, issues connecting the toy via Bluetooth and more.

The Force Kit connects to your PC or tablet using Bluetooth. A blue light on the side of the kit flashes when searching for a connection and is solid when successfully connected, which helps with potential connection hiccups.

Speaking of Bluetoooth, this is another missed opportunity for STEM learnings. Besides being a motion-detector light, the kit is useless without Bluetooth connection to a supporting iPad / Amazon Fire tablet or Windows / macOS PC. Bluetooth is at the core of this toy -- and many everyday electronics kids are likely to encounter -- but this toy doesn’t teach you what Bluetooth is or how it works with this kit.

Coding

The free “Star Wars The Force Coding Kit, by Kano” software (yes, that whole name will appear on your desktop) takes up 194.7MB of storage space. It’s a simple app with Star Wars-themed tutorials that instruct kids to use the app-specific block coding to change various JavaScript animations on the right panel. Perhaps there’s a Lightsaber there that you’re prompted to code to move with your hand as it swipes left and right across the Force Kit. Or maybe you’re tasked with helping a TIE fighter fly through a field of asteroids.

At the time of review, there were three tutorials with 17 lessons total. Kano says that there will be another tutorial with four lessons before the end of November. One of the upcoming tutorials, which sounds like the coolest yet, is called “Influence the Weak Minded.” A spokesperson said the tutorial will focus on “coding Jedi mind tricks,” and “users will learn to control things like Stormtroopers and AT-ATs.”

One of my favorite parts of the software is its use of sensor data. When coding, the right panel, (which also lets you change the background of the canvas to your preferred Star Wars environment), the app always shows how far your hand is from each of the four sensors on a scale of 0 to 100. The image below is an introduction to this feature:

The problem with the app, though, is the majority of these lessons merely direct kids to drag in a particular block or change a value but with little or, sometimes, no explanation for why. Additionally, the canvas you’re coding relies on frames, like all animations; however, this isn’t something that a young child is likely to understand already. Some of the block codes measures things by frames, yet, the app never teaches children how videos are comprised of still frames, a fundamental part of the app.

Some of the first tutorials have a Lightsaber in the canvas change height based on how far your hand is from the sensors on the real-life Force kit and adds the famous Lightsaber hum noise. It’s easy enough to follow the directions to make it work, but there’s minimal explanation of the logic behind your selection.

For example, when it came to the lerp block, the lesson says, “The lerp block will help make the motion of the Lightsaber smoother. Change 0 to -20 so Rey’s lightsaber tilts left when it moves left.” What the lerp?! It continues, “Change 200 to 20 so it tilts right when it moves right.” Come again? Next: “Drag this block into the code space.” Whatever you say K-4NO...no questions asked.

Even basic things, like changing the direction of particle effects representing stars to 360 degrees because that’s a full circle, seem easy and appropriate to teach briefly in a STEM toy. But you won’t find that here.

Below is a screenshot (see how to take screenshots in Windows) from one of the later tutorials. It starts you off with so much code but zero details on what it all does.

Helpfully, when I slid a block into the wrong spot, my instructor, K-4NO, prompted me to put it elsewhere. But you’re not always corrected when making errors during tutorials. For instance, when I entered the wrong number for the blast position of a TIE fighter, it didn’t notice. And you can’t undo; I had to start the lesson over from the beginning to make things work properly.

One thing the app gets right (thank the stars) is the Star Wars theme. If your child wanted a new Star Wars toy, they won’t be left wanting. The app incorporates different characters, costumes and items from the franchise. For example, when building a Lightsaber, you get to style your hilt in the style of Obi-Wan, Luke, Darth Vader, Yoda, Kylo Ren or Rey.

You’re also able to easily toggle the canvas to show the JavaScript version of your block code, but you can’t write code in JavaScript.

Codes automatically save in the “My Creations” section of the app.

Other App Features

The app’s Explore section lets you view codes others users have shared. Unfortunately, there’s no way to search through the different code based on category or keywords. You just scroll through pages of code that aren’t even chronologically ordered.

Children can also share their own programs. When first launching the app, kids are asked to enter a parent/guardian email address. Said adult has to confirm via email that their child can share programs with the Kano World community. According to the email, “these are moderated to remove all personal information.”

Kids can also have or get followers on the app and customize their own avatar, including with Star Wars companions, objects and accessories. There’s also an experience points system. But it seems to work like “Whose Line Is It Anyway” where points don’t seem to mean anything in the game or otherwise (besides bragging rights).

After you’ve become a Jedi--err, Force Coding Kit master-- kids can code freely in the Create section of the app. You have to use the blocks; there’s no way to enter JavaScript code directly.

You can also import/export code as a “KCODE File,” which doesn’t seem like it’ll really ever come in handy.

Battery Life

Each Star Wars The Force Coding Kit comes with two non-rechargeable AA batteries. Kano claims the Star Wars coding kit will last for “over 10 hours of constant play.” During testing, mine was still alive after 9 hours and 10 minutes on with Bluetooth and intermittent usage of sensors, plus RGB lights set to on for the majority of the time. Of course, battery life will depend on your choice of AA batteries after the included ones die.  

Compatibility and Configurations

If your kid’s not into Star Wars, Kano also sells a version of this kit based on the Disney movie Frozen 2. The Kano Disney Frozen 2 Coding Kit is also $79.99, but the toy looks looks like a giant blue snowflake, which is eye-catching but lacks the exposed PCB look I like.  

Both kits are compatible with Windows PC, Apple iPad and macOS and Amazon Fire HD 10 (2017 or newer). Each platform has hardware requirements; you can find the tech requirements here. 

Bottom Line

Kano: Star Wars The Force Coding Kit offers fun block coding that’s certainly simple enough for the recommended ages 6 and up. Building the kit goes from fun to fascinating with the motion sensor RGB lights. The app’s Star Wars theme is lively and captivating with its soft color palette and cute, on-brand tutorials. 

However, the toy could be more educational. Coding tutorials don’t provide much explanations, mostly prompting kids to drag in specific blocks. Unlike competitors, such as the Sphero Bolt, it misses an opportunity to teach about other STEM-related topics like Bluetooth, angles or physics. And while kids can toggle block code into JavaScript, they can never actually write code in JavaScript. 

The similarly priced Sphero Mini brings more to the table, including a gyroscope, accelerometer, cones, mazes and activity cards for creating projects and games. Plus, Sphero’s tutorials are more in-depth, but geared more for classroom settings. Kano is adding lessons, but we’re not sure for how long your kids will want to use this toy for free coding, especially with limited instructions. 

But many other STEM toys will cost you much more than the Star Wars The Force Coding Kit. 

It's a delightful approach to getting your kid at least somewhat interested in block coding and immediately intrigued by motion sensors. Who can resist controlling lights with their hand?

]]> https://www.tomshardware.com/reviews/ryzen-9-3900x-7-3700x-review,6214.html B2EZBLe5xtoyTLqN4cPwUT Thu, 21 Nov 2019 15:40:00 +0000 Thu, 26 Mar 2026 15:32:41 +0000 false false false

AMD's launch of the Ryzen 3000 series processors marks an occasion that was nearly unthinkable a few short years ago: AMD has taken the process lead over Intel by fielding new 7nm processors that contain smaller and more densely-packed transistors than Intel's competing 14nm chips. The advantages of increased density come in the form of higher performance, better power efficiency, more cores, and more cache packed into a smaller area than the first-gen Ryzen models, all of which, as you can see in our CPU Benchmark Hierarchy, makes third-gen Ryzen a potent adversary for Intel both on the desktop and in the data center.

AMD paved the way for the 'Matisse' Ryzen 3000 series several years ago when it unveiled the revolutionary chiplet-based Zen microarchitecture. At the time, AMD laid out a roadmap that included a steady cadence of tick-tock-like updates interspersed with new revisions of the scalable microarchitecture. After the company's sophomore effort with the second-gen Ryzen processors, which featured a faster process paired with the same first-gen Zen design, the company is plowing forward with its Zen 2 architecture that AMD says offers up to 15% more instructions per cycle (IPC). Paired with the advantages of the 7nm process and more cores, not to mention AMD's trailblazing of the PCIe 4.0 interface on desktop platforms, the Ryzen 3000 chips promise an explosive step forward in performance.

AMD's first chips to come packing TSMC's 7nm process span the entire range of the mainstream desktop stack, but push core counts up from eight cores to 12 cores and 24 threads with the Ryzen 9 3900X we have in the lab today, upsetting the status quo and bringing mainstream platforms into what used to be the realm of the pricey high end desktop. If you're looking for something even beefier, AMD also recently released the 16-core Ryzen 9 3950X, which has taken our best CPU list by storm. 

	SEP (USD)	Cores / Threads	TDP (Watts)	Base / Boost Frequency (GHz)	L3 Cache (MB)	PCIe 4.0 Lanes
Ryzen 9 3950X	$749	16 / 32	105W	3.5 / 4.7	64	24
Ryzen 9 3900X	$499	12 / 24	105W	3.8 / 4.6	64	24
Ryzen 7 3800X	$399	8 / 16	105W	3.9 / 4.5	32	24
Ryzen 7 3700X	$329	8 / 16	65W	3.6 / 4.4	32	24
Ryzen 5 3600X	$249	6 / 12	95W	3.8 / 4.4	32	24
Ryzen 5 3600	$199	6 / 12	65W	3.6 / 4.2	32	24

Aside from those halo parts, AMD also has plenty of models that address the bulk of casual users, gamers, and enthusiasts, like the eight-core 16-thread Ryzen 7 3700X we also have in the lab, and a lineup of six-core 12-thread Ryzen 5 models. The Ryzen 7 3700X is particularly impressive with its combination of price and performance putting it squarely among the best gaming CPUs.

AMD is staying true to its enthusiast-friendly roots: Although you can pair the Ryzen 3000 chips with the new X570 chipset, they are also backward compatible with most AM4 socket motherboards. All of the models also come with beefy stock coolers, solder thermal interface material between the heat spreader and die to improve thermal transfer, and unlocked multipliers for easy overclocking. AMD even added support for auto-overclocking for mainstream processors. Pair that with the lower per-core pricing and the debut of the PCIe 4.0 interface for the desktop, and the Ryzen 3000 series appears to be a potent force.

AMD's ability to deliver on its optimistic roadmap in the waning light of Moore's Law is truly impressive, especially as we have become accustomed to never-ending cadences of incremental updates. But at the end of the day it all boils down to real-world performance. Let's see what the Ryzen 3000 series has in store. 

Ryzen 9 3900X

	Process	SEP / RCP (USD)	Cores / Threads	TDP (Watts)	Base Frequency (GHz)	L3 Cache (MB)	PCIe Lanes	Memory Support	iGPU	Price Per Thread
Intel Core i9-9920X	14nm	$1199	12 / 24	165W	3.5 / 4.4	19.25	16 Gen3	Quad-Channel DDR4-2666	No	$49.95
Ryzen 9 3900X	7nm	$499	12 / 24	105W	3.8 / 4.6	64	24 Gen4	Dual-Channel DDR4-3200	No	$20.79
Threadripper 2920X	12nm	$625	12 / 24	180W	3.5 / 4.3	32	64 Gen3	Quad-Channel DDR4-2933	No	$26.04
Core i9-9900K	14nm	$488	8 / 16	95W	3.6 / 5.0	16	16 Gen3	Dual-Channel DDR4-2666	Yes	$61

Make no mistake - from a core count perspective, the $500 12-core 24-thread Ryzen 9 3900X really has no comparison on the mainstream desktop. We have to reach up to Intel's high end desktop (HEDT) platform to find a fair comparison based on core counts. Intel's Core i9-9920X slots in with 12 cores and 24-threads for $1,199, a $700 premium over AMD's Ryzen 9 3900X.

There's no doubt the 3900X also blurs the line between the AMD's own HEDT Threadripper platform and the mainstream desktop: The Threadripper 1920X is AMD's only core-comparable processor. That processors has its own advantages, like access to 64 lanes of PCIe 3.0, and like the -9920X, it supports quad-channel memory. But both company's HEDT chips are much more expensive than the 3900X and require pricey HEDT motherboards.

Back in the familiar realm of the mainstream desktop, Intel's $488 Core i9-9900K serves as the 3900X's primary competitor. The -9900K comes with four fewer cores and eight fewer threads than the 3900X, marking a distinct difference in the price you pay per thread, but the -9900K does hold the clock speed advantage. AMD hopes to offset that advantage with its increased IPC throughput and the 3900X also supports the PCIe 4.0 interface with twice the bandwidth of the -9900K's PCIe 3.0 interface. You'll also notice the Core i9-9900K, known for its high power consumption and intense heat generation, has a lower 95W TDP than the 3900X's 105W rating. We can chalk that up to different measurement techniques. We'll provide extensive power and efficiency testing on the following pages to get a more accurate picture of actual power consumption.

As pictured here, the 39000X comes packing AMD's Zen 2 microarchitecture spread across two small 7nm eight-core compute chiplets tied together with the Infinity Fabric interconnect via a larger 12nm I/O die (IOD). Each small 3900X compute chiplet, referred to as a CCD (Core Chiplet Die), comes with eight physical cores spread across two four-core Core Complexes (CCXes). Each CCX has 16MB of shared L3 cache, totaling 32MB of L3 cache per CCD, and 64MB of total cache for the entire chip. AMD disables two cores per CCD to create the 12-core 3900X.

Each 7nm CCD measures ~74mm² and has 3.9 billion transistors, while the 12nm IOD is ~125mm² and has 2.09 billion transistors. That means the 3900X comes with ~273mm² of silicon that sports ~9.89 billion transistors.

The 3900X's larger cache comes courtesy of the denser 7nm manufacturing process, but it does have a slightly higher latency (on the order of "five or six" clocks) than the 16MB of L3 cache found on previous-generation models. However, the increased capacity allows the processor to store more data closer to the execution cores, thus increasing cache hit rates that ultimately yield more performance. AMD also decreased the size of its L1 instruction cache from 64KB with the first-gen Zen processors to 32KB for Zen 2 chips. This allowed the company to expand its microop cache, and paired with changing the L1 instruction cache from 4-way to 8-way associativity, AMD feels this provides a more balanced approach to its cache subsystem. 

The -9900K's 16MB of L3 cache pales in comparison from a capacity standpoint, but cache bandwidth and latency are more important metrics. We'll put hard numbers behind the differences on the following pages.

As a sidenote, AMD now calls its combined L2+L3 cache "GameCache" to highlight to casual consumers the importance of cache to gaming performance, but we'll stick with the established terms.

Ryzen 7 3700X

The eight-core 16-thread Ryzen 7 3700X slots in at $329 and comes with a 65W TDP rating, which is significantly lower than the competing Core i7-9700K's 95W rating. You'll notice that AMD has maintained similar price points for the new models compared to the previous-gen Ryzen 7's, but we caution that pricing is a moving target for the last-gen chips.

	Process	SEP / RCP (USD)	Cores / Threads	TDP (Watts)	Base Frequency (GHz)	Total Cache (MB)	PCIe Lanes	iGPU	Price Per Thread
Core i9-9900K	14nm	$488	8 / 16	95w	3.6 / 5.0	16	16 Gen3	Yes	$30.05
Ryzen 7 3800X	7nm	$399	8 / 16	105W	3.9 / 4.5	32	24 Gen4	No	$24.94
Core i9-9700K	14nm	$374	8 / 8	95W	3.6 / 4.9	12	16 Gen3	Yes	$46.75
Ryzen 7 2700X	12nm	$329	8 / 16	105W	3.7 / 4.3	16	20 Gen3	No	$20.56
Ryzen 7 3700X	7nm	$329	8 / 16	65W	3.6 / 4.4	32	24 Gen4	No	$20.56
Core i7-9700	14nm	$323	8 / 8	95W	3.6 / 4.9	12	16 Gen3	Yes	$40.38

Although third-gen Ryzen pricing is close to the current-gen processors on sale, this is far lower than the per-core pricing at the launch of the previous gen. Normalize the numbers to price-per-thread, and its clear AMD maintains a pricing advantage over Intel's lineup. But performance varies based on architecture, so the price-to-performance ratio is where the rubber meets the road.

The Ryzen 7 3700X features a single CCD with all eight active cores connected to the I/O die, highlighting that the company's Zen 2 architecture is inherently scalable. Threadripper processors also come with varying numbers of compute dies, but substitute in 'dummy' dies to ensure structural rigidity and prevent crushing the integrated heat spreader (IHS) when you tighten down your cooler. The smaller surface area of the 2700X's IHS doesn't require a dummy die, so this pad is simply left unoccupied.

AMD hasn't sampled the Ryzen 7 3800X yet, which features a higher 105W rating and 3.9 / 4.5 GHz base/boost clocks, which is higher than the Ryzen 7 3700X's 3.6 / 4.4 GHz base/boost frequency. It also looks like a compelling part, so look to these pages for a review soon. 

Both the Ryzen 9 3900X and the Ryzen 7 3700X come with the bundled Wraith Prism RGB cooler that features four direct-contact copper heat pipes, three independent RGB zones, switchable fan profiles, and a 39 dB(A) noise rating. The cooler is rated to dissipate 116W of waste heat in "L" mode (2800 RPM) and 124W in "H" mode (3600 RPM). Cooler Master manufactures the heat sink/fan, while AMD provides software for controlling the lighting and fan profiles. Company representatives claim the cooler represents a roughly $43 value, and that it also allows for some overclocking headroom. Intel's K-series models, in contrast, don't come with a bundled cooler.

Memory Subsystem and Overclocking, Infinity Fabric

Ryzen 3000 chips support dual-channel DDR4-3200, a step up from the previous-gen's support for DDR4-2966. That should boost performance significantly because the Zen 2 microarchitecture, like its predecessor, benefits heavily from increased memory performance (particularly in gaming).

AMD's new Zen 2 microarchitecture uses a centralized memory controller on the I/O die, which helps ensure consistent memory latency in the multi-die Ryzen 9 models. It also improves cache access latency. AMD has also overhauled the Infinity Fabric, doubling its throughput by increasing the previous-gen 256-bit interconnect to 512-bit, which facilitates access to memory and enables the PCIe 4.0 interface. AMD also instituted more fine-grained Infinity Fabric quality of service controls and claims to have reduced the amount of energy required to transfer a bit by 27%. 

AMD has improved memory overclocking substantially, partly due to decoupling the Infinity Fabric from the memory clock. AMD's first-gen Ryzen processors had plenty of difficulties with memory overclocking when they first launched, but AMD has addressed those concerns with the second-gen products and has even demoed an air-cooled Ryzen platform running at DDR4-5100. We also didn't encounter any issues during our testing.

As with previous-gen Ryzen, memory overclocking confers big performance speedups for gaming. To sidestep the Infinity Fabric's maximum frequency of 2,000 MHz, which effectively constrains memory overclocking, AMD allows users to separate the memory and Infinity Fabric clock dependencies. The domains remain tied together at a 1:1 ratio up to DDR4-3600, but run at a 2:1 ratio beyond that transfer rate. This setting, which is also user-adjustable in the BIOS, improves memory bandwidth but comes with a latency penalty (~9ns). Tuners can also adjust the Infinity Fabric clock (fclk) in 33Mhz increments to get an extra kicker during overclocking. AMD says that the price/performance sweetspot will be around DDR4-3600.

As before, AMD supports up to 128GB of RAM and enables ECC support, but AMD leaves qualification and enablement of the feature up to motherboard vendors.

DIMM Config	Memory Ranks	Official Supported Transfer Rate (MT/s)
2 of 2	Single	DDR4-3200
2 of 4		DDR4-3200
4 of 4		DDR4-2933
2 of 2	Dual	DDR4-3200
2 of 4		DDR4-3200
4 of 4		DDR4-2667

As seen with the first-gen Zen chips, AMD's official supported memory data transfer rates vary based on the type of DIMM (single rank or dual rank) and the number of populated channels, as outlined above.

PCIe 4.0 Comes to the Desktop

Ryzen 3000 processors support the PCIe interface on X570 motherboards, and while the chips will drop into some previous-gen AM4 motherboards, the processor will downshift into PCIe 3.0 on those platforms. AMD has also infused the new technology into its "Navi" Radeon 5000 series GPUs and worked with storage vendors to assure a supply of speedy new PCIe 4.0 SSDs. We recently had the opportunity to take an early look at PCIe 4.0 SSD performance, which you can see here.

	Bandwidth	Gigatransfer	Frequency	Encoding
PCIe 3.0	32 GB/s	8 GT/s	8.0 GHz	128b/130b
PCIe 4.0	128 GB/s	16 GT/s	32.0 GHz	128b/130b

PCIe 4.0 provides yet another advantage for performance seekers, particularly in the content creation realm, over Intel's platform, but it doesn't materially impact gaming performance (at least not yet). The new interface also comes at the cost of higher pricing for X570-equipped motherboards due to tighter signalling requirements. Those prices could recede over time as the pricing of the PCIe 4.0 component ecosystem, like switches and redrivers, benefit from economies of scale, but AMD has wisely encouraged its partners to continue offering the current-gen X470 motherboards that will now serve as a lower tier of motherboards.

AMD's new Ryzen 3000 series lineup is fully compatible with existing X470 motherboards and will operate at their full performance on the previous-gen boards, albeit at the loss of PCIe 4.0 connectivity. That shouldn't be too much of a concern for users without PCIe 4.0 devices or SSD RAID storage arrays that hang off the chipset. Fast storage arrays will certainly benefit from the faster PCIe 4.0 connection between the chipset and processor, though. 

Ryzen-Specific Windows 10 Scheduler Updates

AMD worked with Microsoft to deliver on a much needed feature: A Ryzen-aware scheduler. The new scheduler arrived with the Windows 10 May update and benefits both current-gen and previous-gen Ryzen models (Threadripper and Ryzen 3000 processors).

The new scheduler pins threads within a single CCX (the four-core clusters inside each CCD) before scheduling threads to other CCXes. This approach reduces latency during thread synchronizations or frequent cache accesses, thus improving performance for all existing Ryzen processors. AMD says the feature doesn't benefit all applications, but can result in significant performance improvements in those that do.

AMD also introduced its Collaborative Power Performance Control 2 (CPPC2) feature, which is a software feature that manipulates Ryzen 3000's power states from within the operating system. This is similar to Intel's Speed Shift technology and reduces power state transition latency from 30ns to 1ns, which ultimately saves power and boosts efficiency. The feature comes enabled in the latest AMD chipset drivers and the Windows 10 May update (and newer).

As before, these mainstream models don't come with integrated graphics, meaning you'll need a discrete GPU.

MORE: Best CPUs
MORE: CPU Benchmark Hierarchy
MORE: All CPUs Content

TSMC 7nm Process

AMD tapped TSMC's 7nm process for the Ryzen 3000 series processors. AMD's first-gen Ryzen processors debuted on GlobalFoundries' 14nm GPP node, but the 2000-series CPUs moved to GloFo's 12nm LP process technology. The ported-over design helped boost transistor performance, but did not affect die area or transistor density. As a result, Pinnacle Ridge's ~4.8 billion transistors and 213mm² area remained the same as first-gen Ryzen.

In contrast, TSMC's 7nm process represents a true shrink that provides twice the transistor density. AMD says the process allowed it to shrink the CCX by 29% relative to the 12nm process, which helped pave the way for Zen 2's enhancements, like the doubled L3 cache capacity and the ability to double core counts within the same package dimensions. It's also important to note that the company also removed I/O and memory controllers from the compute chiplet this time around, resulting in even smaller packages.

AMD also claims the process affords up to 350 more MHz of core frequency at the same voltage as the 12nm LP process. The new process also delivers on the energy efficiency front with up to 75% higher performance-per-watt compared to the 12nm LP process. AMD also says the 7nm node produces up to 58% higher performance-per-watt than Intel's aging, but highly refined, 14nm++ process, but be aware that the Ryzen 3000 chips still have a 12nm I/O die that contributes to the chip's overall power consumption.

AMD says that the 15% increase in IPC throughput from the Zen 2 microarchitecture serves up 60% of the performance improvements seen in the Ryzen 3000 series chips, with the remaining 40% coming from the 7nm process and frequency improvements. 

Zen 2 Microarchitecture

Zen's modular and scalable design provides AMD with plenty of advantages in terms of cost and time to market, and fine-grained tuning to the architecture has yielded phenomenal results.

AMD has improved IPC by roughly 15% (though that can vary by workload), doubled the L3 cache size to keep data as close to the execution units as possible, and doubled floating point performance by expanding floating point bandwidth to 256-bit to improve performance with AVX2 instructions.

Headline improvements include a doubled micro-op (4K) and L3 cache (32MB), which came at the expense of a slightly smaller L1 instruction cache that is now an 8-way associative 32K block as opposed to the 64K block with 4-way associativity on first-gen Ryzen. AMD also beefed up the Translation Lookaside Buffer (TLB) to 2,000 entries.

AMD now has a double-stage branch predictor, with its Perceptron predictor handling the first stage while a new TAGE branch predictor, which features larger lookup tables to improve performance, serves as the second stage. That's paired with larger L1 and L2 branch target predictors (BTBs) that increase throughput by reducing stalls. AMD says the improved branch predictor expends extra energy on the front end, but the 30% lower misprediction rate ultimately saves more energy on the backend. A third address generation unit (AGU) also keeps the hungry execution cores fed with data from main memory.

Enter the X570 Chipset

AMD's Ryzen 3000 series processors have dynamic algorithms that adjust parameters based upon several factors, with power delivery and heat dissipation being the chief variables that can unlock extra performance. As such, motherboard selection is going to be a big factor in the amount of performance you receive if you choose to use AMD's Precision Boost Overdrive (PBO - next page) and Auto Overclock features. The X570 motherboard ecosystem has proven to be pricey compared to the previous-gen X470 models, but AMD says that the Ryzen 3000 series processors will operate at full performance at stock settings with X470 motherbaords. You just sacrifice access to the PCIe 4.0 interface.

The actual X570 chipset is a 14nm variant of the 12nm I/O die inside the Ryzen 3000-series processors, which is a clever reuse of the technology that ultimately lowers costs. This chipset is also fully produced by AMD, whereas the X470 chipset came from ASMedia, which says it will continue to produce some chipsets for Ryzen 3000 series processors. AMD uses the smaller 12nm process for the processor's in-package I/O die to leverage the increased frequency potential for the memory controllers. That improves memory data transfer rates, but AMD uses the more economical 14nm variant, which has its memory controllers disabled, for the chipset die.

Most X570 motherboards come with a fan on the chipset to provide active cooling for the chipset, which now consumes ~11-15W compared to the 6W consumed by the X470 chipset. That's due to the power-hungry nature of the PCIe 4.0 interface when it is under full load. Small fans like these tend to be noisy, but our motherboard team is hard at work on the first wave of X570 motherboard reviews and will provide more perspective. 

Ryzen 3000-series chips are compatible with most previous-gen motherboards with the AM4 socket, but some updates are left to vendor discretion. As such, you won't be able to drop a new Third-gen Ryzen chip into all X370 and B350 motherboards, and A320's upgrade path is blocked entirely. Due to the uneven application of BIOS updates across the various vendors, and even among different motherboards in the respective product stacks, you'll have to check the CPU support list for your X370 or B350 motherboard to ensure it supports Third-gen Ryzen.

There are plenty of X470 and B450 motherboards still on the market, but some of the boards that have been in the supply chain for a while will need a BIOS update before you install a Third-gen Ryzen processor. As we've seen in the past, that isn't always possible if you don't already have a Ryzen processor or if the motherboard doesn't have an out-of-band BIOS update feature, like BIOS Flashback. AMD also announced that all motherboards that support Ryzen 3000 processors out of the box will come with a new badge to help simplify things.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Zen 2 Instructions Per Cycle (IPC)

It's important to remember that IPC can vary by workload, so dissimilar tasks may yield different outcomes. We set a static 3 GHz clock rate and dialed memory to the respective processors' supported frequency for the following tests:

All of the processors in this test come with eight cores and sixteen threads, so we left the core allocations unaltered and the Ryzen 7 1800X serves as our baseline comparison. These apples-to-apples tests expose a significant boost moving from the first-gen to third-gen Ryzen's, with single-threaded IPC improvements ranging from 5% to 18% for most applications. AVX-heavy workloads receive the biggest benefit with the AVX y-cruncher benchmark exposing a 70% and 163% increase in single- and multi-threaded workloads, respectively. That comes as a side benefit of AMD's move to a 256-bit floating point unit instead of splitting AVX workloads into two instructions fed across two cycles. Performance improvements are more muted with cryptographics workloads, which only experience a ~5% uplift.

AMD used SPECviewperf 13 to measure its IPC improvements, and it's clear it's results are more than plausible, if not a conservative estimate. Removing our results from y-cruncher, which is clearly a standout, and the crytpographic workloads yields an average 13% IPC uplift, which isn't too far off from AMD's official claim of 15%. Throwing in the y-cruncher and cryptographic tests yields a whopping 18% in IPC uplift.

Power Consumption

Power consumption measurements are always a bit tricky. But as long as your 12V supply (EPS) readings, motherboard power supply sensor values, and voltage transformer losses plausibly coincide, everything is fine. Therefore, we're using pure package power to avoid possible influences from our motherboard. Results from the PWM controller are very reliable if you take them as averages over a few minutes.

We first measured power consumption during an AIDA stress test, but we disabled AVX instructions. The Ryzen 7 3700X beats the pack with 90W of package power consumption under full load, trailed slightly but the Core i7-9700K. The Ryzen 9 3900X pulls 142W at stock settings, and that increases to 168W when we engage the new "Auto OC" and Precision Boost Overdrive features. That is 29W more than the stock Core i9-9900K during this test, but the 3900X comes with four more cores, so performance efficiency will be the real judge of power consumption.

We're moving away from using AVX-based stress tests for our CPU power testing, though we will continue to use them for their intended purpose of validating overclocks. AVX-based stress testing utilities essentially act as a power virus that fully saturates the processor in a way that it will rarely, if ever, be used by a real application. Those utilities are useful for testing power delivery subsystems on motherboards, or to generate intense thermal loads for case testing, but they don't provide a performance measurement that can be used to quantify efficiency.

The y-cruncher benchmark computes pi using a heavy multi-threaded AVX workload and also generates a performance measurement that we can use for efficiency metrics. We're also adding in HandBrake in x264 and x265 flavors. The latter uses a heavier distribution of AVX instructions than the former, but both transcoders are great for stressing the processor with a real-world workload. As we can see, the Ryzen 7 3700X sucks the least power of the group during the tests, but we should also bear in mind that it also has the lowest TDP rating.

As a sidenote, we tested Intel's Core i9-7920X as part of our test pool, but removed the power results due to incorrect reporting from the motherboard's sensor loop.

Combining the performance metrics recorded from the three applications, we can see that the Ryzen 7 3700X is an incredibly efficient processor given its level of performance, and the beefy Ryzen 9 3900X also impresses, though you could argue the overclocked configuration consumes a lot more power in exchange for a relatively tiny gain in performance. In either case, the 7nm process obviously confers a solid power-to-performance ratio.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Precision Boost Overdrive, AutoOC, and Ryzen Master Software

AMD's Precision Boost Overdrive (PBO) is a boon to enthusiasts with its adaptive overclocking approach, and it's making its way from the Threadripper platform to all of AMD's Ryzen 3000 processors. The software allows the processor to communicate with the platform to modulate performance based on the motherboard's power delivery subsystem and thermal dissipation capabilities.

The processor monitors Package Power Tracking (PPT) and Thermal Design Current (TDC) variables, measuring available margin to the motherboard's maximum power output and current, respectively. Electrical Design Current (EDC) also indicates the maximum current possible from the VRMs during peak/transient conditions. A control loop feeds real-time telemetry data back to the processor, which then dynamically adjusts performance based on thermal and power conditions. AMD also exposes some of these monitoring features with its Ryzen Master overclocking software.

Motherboard vendors define the power limits for their boards and are developing custom profiles that support a new Auto OC feature. This new feature grants you some control over the maximum attainable boost clocks by allowing you to add up to an extra 200MHz to the maximum boost clock, but it isn't guaranteed that the processor will reach those speeds at all times, or under all conditions. Instead, the processor will still respect the limits imposed by the motherboard maker. AMD says that Auto OC is designed to improve performance in single-threaded workloads, while PBO boosts heavily-threaded applications. In either case, you can toggle both settings simultaneously for the best of both worlds.

Our Overclocking Efforts

Due to time constraints, we tested the Ryzen 9 3900X and Ryzen 7 3700X with both automated overclocking features activated instead of with a manual all-core overclock. Several motherboard vendors have told us that overclocking headroom is extremely limited on the Ryzen 3000 processors, and that exceeding the boost clocks, or even meeting them, isn't possible for all-core overclocking. Our resident overclocking expert Allen 'Splave' Golibersuch has also spent time with early Ryzen 3000 samples and was unable to break the 4.1 GHz barrier without sub-ambient cooling.

In either case, the combination of PBO and AutoOC yielded improvements in some applications, but wasn't as impressive with the Ryzen 7 3700X as it was with the Ryzen 9 3900X. In some cases, the boost confers no benefit for the Ryzen 7 3700X in our application testing, and on a few occasions, we see performance regressions in lightly-threaded workloads compared to the stock configuration. We tested with multiple motherboards and met with the same result, which could boil down to the quality of our sample or motherboard firmwares. As with most processor launches, motherboard firmwares are still a work in progress, so there is hope that the situation will improve. We'll update our results when a fix becomes available, but we did encounter this issue the night before NDA lift, so hopefully a fix will come soon. 

We regularly observed our Ryzen 9 3900X maintaining an all-core 4.1 GHz during our testing, while the Ryzen 7 3700X often peaked at 4.125 GHz.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

The new AMD-optimized Windows scheduler is only present in Windows 10 1903 and promises to expose gains in several types of applications. As such, we updated our test image to the latest version of Windows 10 available at the time of publication (18362.207). All of our test results come from the aforementioned operating system and include all publicly available security mitigations and the latest motherboard firmware revisions. Intel is currently impacted by Spectre, Spectre v4, Meltdown, Foreshadow, Spectre v3a, Lazy FPU, Spoiler, and MDS, while AMD is only impacted by Spectre and Spectre v4. AMD has added hardware-based mitigations for both variants of Spectre, which should reduce the performance impact, but the requisite patches for both companies have performance penalties, which also furthers the need to move forward to the latest operating system available.

We also revamped our game suite, updated to all of the latest versions of application tests, adding a few more along the way, and expanded our power testing suite. We also moved from an EVGA Nvidia GeForce 1080 FE graphics card to the Nvidia GeForce RTX 2080 Ti for game testing. We use a Gigabyte GeForce RTX 2080 for synthetic tests to streamline our testing process.

Other improvements include moving from SATA SSDs to Intel's 2TB DCP4510 NVMe SSDs. It helps that the drive delivers 3,200/2,000 MB/s of sustained sequential read/write throughput, which speeds up the imaging process.

All applications, drivers, and BIOS revisions are up-to-date as of seven days prior to the publication date (excluding the Ryzen 3000 BIOS, which is two days old). Due to the significant overhaul of our testing methodology and systems, all test results in this review are not directly comparable to previous reviews, but will be comparable moving forward.

A Note on Multi-Core Enhancement (MCE)

Intel's motherboard partners have infused their boards with predefined all-core boost profiles that go by many names, such as Multi-Core Enhancement (MCE) with ASUS motherboards and Enhanced Turbo with our MSI motherboard. These features are largely referred to as MCE, but the functionality remains the same: These settings essentially apply an all-core overclock to the processor that is defined by the maximum Turbo Boost bin supported by the processor. This setting modifies the CPU's clock rate and voltage to deliver higher performance, which is basically factory-sanctioned overclocking.

MSI turns this on by default in its BIOS, similar to most of its competition. Performance, power consumption, and heat are all affected, naturally. We manually disable this feature for our stock CPU testing to best reflect Intel's specifications. 

MSI MEG X570 Godlike

We're using MSI's MEG X570 Godlike as our test platform for the second- and third-gen AMD processors. Due to the compatibility matrix for the AM4 socket, we stepped back to the MSI X470 Gaming M7 AC for the Ryzen 7 1800X.

The pricey Godlike board retails for around $800, but has the 14+4+1-phase power delivery subsystem to support aggressive overclocking.

The MEG X570 Godlike sits at the top of MSI's motherboard hierarchy. It also comes with a few nifty accessories likea 10Gb “Super LAN” Ethernet card and a PCIe Gen 4 Xpander-Z M.2 expansion card. That let's you add two more M.2 drives to complement the three M.2 PCIe Gen 4 M.2 ports on the board. You also get four PCIe 4.0 x16 slots, an RGB Mystic Light Infinity II mirror over the IO shroud, and a tiny OLED screen, alongside the two-digit LCD display for error codes.

Comparison Products

Intel Core i9-9900K

Intel Core i7-9700K

Ryzen 7 2700X

Test System and Configuration

AMD Socket AM4 (X570)
	AMD Ryzen 9 3900X, Ryzen 7 3700X, Ryzen 7 2700X
	MSI MEG X570 Godlike
	2x 8GB G.Skill Flare DDR4-3200
	Ryzen 3000 - DDR4-3200, DDR4-3600
	Second-gen Ryzen - DDR4-2933, DDR4-3466
Intel LGA 1151 (Z390)
	Intel Core i9-9900K, i7-9700K
	MSI MEG Z390 Godlike
	2x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2667 & DDR4-3466
AMD Socket AM4 (X470)
	AMD Ryzen 7 1800X
	MSI X470 Gaming M7 AC
	2x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2933
AMD Socket SP3 (TR4)
	AMD Threadripper 2920X
	MSI MEG X399 Creation
	4x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2933
Intel LGA 2066
	Intel Core i9-7920X
	MSI X299 XPower Gaming AC
	4x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2666
All Systems
	Nvidia GeForce RTX 2080 Ti
	2TB Intel DC4510 SSD
	EVGA Supernova 1600 T2, 1600W
	Windows 10 Pro (1903 - All Updates)
Cooling
	Corsair H115i
	Custom Loop, EKWB Supremacy EVO waterblock, Dual-720mm radiators
	AMD Wraith Prism Stock Cooler
	Enermax Liqtech 240 TR4 II

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

We tested the Threadripper 2920X in Game Mode for our game suite, and Creator Mode for our application tests.

VRMark, 3DMark

We aren't big fans of using synthetic benchmarks to measure performance, but 3DMark's DX11 and DX12 CPU tests provide useful insight into the amount of horsepower available to game engines.

The DX11 and DX12 CPU test results expose the full threaded heft of the Ryzen 3000 series processors. The Ryzen 9 3900X even manages to dethrone the overclocked Core i9-9900K in both tests.

The VRMark test benefits heavily from per-core performance, and the Ryzen 3000 processors have made great strides compared to the first- and second-gen models. You'll notice that our combined Precision Boost Overdrive and AutoOC configuration leads to slightly lower performance for the Ryzen 7 3700 in this test, while the 3900X experiences a small benefit. That's a trend that we'll see repeat in some of our application tests. We've reached out to both MSI and AMD on the matter, and will update these results when a fix becomes available.

Intel's Core i7-7920X is the only twelve-core Intel processor we have on hand for testing, so we're including it in our test pool. Be aware that this is a previous-gen model, so the newer Core i9-9920X, which is based on the same architecture, offers more performance via incremental improvements to its all-core boost frequencies. 

Ashes of the Singularity: Escalation

Ashes of the Singularity: Escalation is a computationally intense title that scales well with thread count, but clock speeds and per-core performance play a big role, as evidenced by the overclocked Core i9-9900K's commanding performance. However, both the Ryzen 9 3900X and the Ryzen 7 3700X beat the -9900K in stock trim.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Civilization VI AI Test

This Civilization VI test mesures AI performance in a turn-based scenario and tends to prize per-core performance. The 3900X doesn't benefit from the auto-overclocking features, and the 3700X again suffers a slight decline in performance, indicating there are still a few kinks to work out. In either case, both processors at stock settings easily beat their previous-gen predecessors, even when they're overclocked. 

Civilization VI Graphics Test

Warhammer 40,000: Dawn of War III

Tthe Warhammer 40,000 benchmark responds well to threading, but it's clear that Intel's per-core performance advantage has a big impact.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Far Cry 5

Final Fantasy XV

We run this test with the standard quality preset to sidestep the impact of a bug that causes the game engine to render off-screen objects with the higher-resolution setting.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Grand Theft Auto V

Grand Theft Auto V favors Intel architectures and, more generally, multi-core designs with high clock rates.

Hitman

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Project CARS 2

Although Project CARS 2 is purportedly optimized for threading, clock rates obviously affect this title's frame rates. Intel's per-core performance advantage pays big dividends in this title.

The Division 2

World of Tanks enCore

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Web Browser

The Krakken suite evaluates JavaScript performance using several workloads, including audio, imaging, and cryptography. Like most browser-based benchmarks, single-threaded performance reigns supreme. Browsers tend to be impacted more by the recent security mitigations than other types of applications, resulting in reduced performance from the Intel processors in these benchmarks. AMD's improved IPC comes into play as the 3900X takes the lead in Krakken. The stock Ryzen 7 3700X also grapples with the overclocked Core i7-9900K and i9-9900K, which is a surprising turn of events in a lightly-threaded application.

Surprisingly the Ryzen 3000 processors lag the 2700X in the WebXPRT 3 suite, but are far more competitive in the Speedometer benchmark.

Microsoft Office

Microsoft's office suite makes its debut in our test suite via PCMark 10's new application test. This benchmark tests with real Microsoft Office applications, and we can see that the Ryzen 3000 series processors are very competitive in Excel, the Edge browser, and Word.

Productivity

The application start-up metric measures load time snappiness in word processors, GIMP, and Web browsers under warm- and cold-start conditions. Other platform-level considerations affect this test as well, including the storage subsystem. The 3000-series processors occupy the middle of the ranks, but it will be interesting to revisit this benchmark with a PCIe 4.0 SSD in the future.

Our video conferencing suite measures performance in single- and multi-user applications that utilize the Windows Media Foundation for playback and encoding. It also performs facial detection to model real-world usage.

The photo editing benchmark measures performance with Futuremark's binaries using the ImageMagick library. Common photo processing workloads also tend to be parallelized, which plays well to Ryzen's multi-threaded heft.

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Rendering

It shouldn't surprise anyone to see the 12-core 24-thread 3900X bring a taste of HEDT performance to the multi-threaded rendering benchmarks. Ryzen 3700X also performs well given its price point.

Encoding and Compression

Our threaded compression and decompression metrics work directly from system memory, removing storage throughput from the equation. Ryzen 3000's improved memory performance, along with the generous helping of cores, plays a big role in its commanding lead.

Core i9-9900K traditionally leverages high frequencies to dominate the HandBrake x265 test, which relies heavily on AVX instructions, and the H.264 test. But Ryzen's improved AVX throughput shakes up the status quo, stealing the lead from the incumbent. We can also see the vast improvement in Ryzen's AVX performance in the y-cruncher tests.  

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

Conclusion

AMD’s Ryzen 3000 series represent yet another big step forward as the company leads the way with the first 7nm processors for the desktop PC and brings the first PCIe 4.0-enabled platform to market. The benefits of the 7nm process paired with the Zen 2 microarchitecture, and its big boost to IPC, manifest as a more power efficient platform with higher core counts than competing chips, and at a lower price per thread, which places both products but especially the 3700X among the best gaming CPUs you can get.

The Ryzen processors are extremely competitive in performance across the full span of our gaming and application test suites, notching impressive wins in heavily-threaded applications and significantly narrowing the gap in the lightly-threaded applications that Intel has traditionally dominated. To put things in perspective, consider that the overclocked Ryzen 7 2700X rarely matched the stock performance of the Ryzen 7 3700X.

Intel still holds the absolute performance crown in gaming, but much of that performance advantage will be less noticeable when gaming at higher resolutions, or if you pair the processors with a lesser graphics card.

AMD is also taking the leadership position by delivering the first PCIe 4.0-enabled platform for the desktop PC, a role that we would typically expect the market leader to fill. Unfortunately the faster interface does result in higher-priced X570 motherboards, but AMD has wisely encouraged its partners to continue to offer X470 motherboards, which are cheap and plentiful. You'll lose access to the PCIe 4.0 interface in exchange for lower pricing, but you'll also have a compelling upgrade path in the future.

AMD continues to offer as much backward compatibility as it can given its expanding portfolio, earning kudos from the enthusiast community, and is also staying true to its standard value proposition of offering more for less. Both the Ryzen 9 3900X and the Ryzen 7 3700X come with a beefy bundled Wraith Prism cooler that can even provide a bit of overclocking headroom, too.

AMD also continues to offer fully unlocked processors for all models and allows overclocking on value-centric motherboards, which has long been a sore point for enthusiasts that have to pay a premium for access to Intel's overclocking features. AMD is even expanding on that with the introduction of Precision Boost Overdrive and AutoOC features that bring overclocking to mainstream users through a few clicks in its easy-to-use Ryzen Master utility. Intel has responded in kind with its Intel Performance Maximizer, but that software is only compatible with the company's pricey 9th-Generation processors. That said, Intel obviously still holds the overclocking crown, but that's becoming less of an advantage in the face of processors that come with up to twice the cores.

The Ryzen 9 3900X redefines our expectations for the mainstream desktop with a beastly 12-cores and 24-threads and represents a great value if you're seeking a well-rounded performer. The extra cores and threads will pay big dividends in productivity applications, and the solid performance in more common lightly-threaded applications is more than enough for most users.

The Ryzen 7 3700X slots in as the more accessible counterpart that will appease the vast majority of customers, and it also comes with the many of the same attractions of the previous-gen model, except it is faster and consumes less power. If you're looking for the best value on the market, the Ryzen 7 3700X is your chip.

Image Credits: Tom's Hardware

MORE: Best CPUs
MORE: Intel & AMD Processor Hierarchy
MORE: All CPUs Content

]]> https://www.tomshardware.com/news/google-stop-search-indexing-flash-adobe gyibiUybsFsbT4QniJLxCV Tue, 29 Oct 2019 14:49:32 +0000 Tue, 16 Sep 2025 13:28:08 +0000 false false false

Adobe Flash will officially keel over in 2020. Its presence on the web might be forgotten even sooner than that, however, because Google announced yesterday that its search engine will stop indexing Flash content by the end of the year.

The question used to be "if a tree falls in the forest but nobody's around to hear it, does it make a sound?" Now, it's "if something exists on the Internet but Google doesn't index it, does it really exist?" Search has become the default way of finding stuff online--Flash's disappearance from Google's results basically makes it invisible.

Here's the good news: Google isn't removing websites that have Flash content from its search results. That would be a disaster, because people who operate sites that still rely on Flash probably wouldn't be technically savvy enough to understand why they've disappeared from Google. The pages containing Flash content will remain.

Instead, "in Web pages that contain Flash content, Google Search will ignore the Flash content," Google explained. Google will also "stop indexing standalone SWF files." But the search tool assured us that "most users and websites won't see any impact from this change" to Google Search.

This isn't Google's only method of helping Flash along its journey into the afterlife. The plugin's disabled by default in Chrome, and the company plans to completely remove support for Flash from its browser by the end of 2020. (These changes also affect the Chromium-based version of Edge that Microsoft's been developing.)

Many have acknowledged that Adobe ending Flash support marks the end of an era. Google said in its blog post that the plugin "was the answer to the boring static web, with rich animations, media and actions" and was "a prolific technology that inspired many new content creators on the web." But now it's time for Flash to fade away.

]]> https://www.tomshardware.com/news/pdfex-pdf-files-security-vulnerabilities-viewer,40542.html ko9CtzuubaUXCfWTsmLnAV Thu, 03 Oct 2019 13:52:01 +0000 Wed, 05 Feb 2025 14:19:19 +0000 false false false

Researchers from Ruhr University Bochum and Müns­ter Uni­ver­si­ty revealed PDFex, two vulnerabilities of PDF files that undermine the encryption used to secure their contents. One vulnerability lets attackers manipulate parts of the file to enable direct exfiltration attacks, and the other can be used to "modify existing plaintext" and "construct entirely new encrypted objects."

The first vulnerability works because "the PDF specification allows the mixing of ciphertexts with plaintexts," the researchers explained, and potential attackers could then use "further PDF features which allow the loading of external resources via HTTP" to steal the file's contents. They managed to exfiltrate data from an encrypted PDF via PDF forms, hyperlinks and JavaScript code added to the original document.

The second vulnerability results from PDF encryption's use of "the Cipher Block Chaining (CBC) encryption mode with no integrity checks, which implies ciphertext malleability." This lets attackers "create self-exfiltrating ciphertext parts using CBC malleability gadgets." Attackers can use the same methods of exfiltration--PDF forms, hyperlinks and JavaScript--to access file contents after exploiting this vulnerability.

This isn't an isolated problem. The researchers explained that many companies rely on PDF encryption. Some, like Canon and Samsung, use PDF encryption in their scanners. IBM offers "PDF encryption services for PDF documents and other data (e.g., confidential images) by wrapping them into PDF," they said, and PDF encryption can also be used to keep medical records secure during transfer. 

The PDFex vulnerabilities are also hard to avoid because they're problems with the PDF format itself. The researchers said their "evaluation shows that among 27 widely-used PDF viewers, all of them are vulnerable to at least one of those attacks, including popular software such as Adobe Acrobat, Foxit Reader, Evince, Okular, Chrome, and Firefox." They shared more information about this evaluation on a dedicated website.

]]> https://www.tomshardware.com/news/microsoft-patches-internet-explorer-security-flaw,40466.html qpZZxHE72XonsYB9g2PNVD Tue, 24 Sep 2019 14:35:00 +0000 Wed, 05 Feb 2025 14:16:46 +0000 false false false

There's good news and bad news. The good news is that Microsoft patched an Internet Explorer security vulnerability that enabled remote code execution on Monday. The bad news is that the company released this patch via a cumulative update to Windows 10, and saying its track record with those updates has been hit-or-miss lately would be an understatement, given the many problems Windows users have reported over the last few weeks.

Let's talk about the vulnerability first. It was assigned the identifier of CVE-2019-1367 and, according to Microsoft, was patched before it was publicly disclosed. (Although it has been exploited, according to the company.) Internet Explorer versions 9-11 were affected on Windows 7, 8.1 and 10 as well as several versions of Windows Server. Microsoft said there were no mitigations or workarounds capable of handling the flaw without this update.

Here's what the company said about the vulnerability itself:

"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

Microsoft said that someone could set up a website designed to exploit this vulnerability whenever someone using Internet Explorer viewed it. As easy as it would be to say that anyone still using Internet Explorer is practically asking for trouble, the reality is that many people still rely on the browser, and people who aren't tech savvy enough to use a modern browser would be particularly vulnerable to attacks like the one Microsoft described.

This update "addresses the vulnerability by modifying how the scripting engine handles objects in memory," Microsoft said, but it didn't offer any specifics. There don't appear to be any other changes in the KB4522016 cumulative update released yesterday; problems affecting certain Input Method Editors as well as Windows audio remain in the "known issues" section of the company's support article about the release.

]]> https://www.tomshardware.com/news/chrome-76-prevents-incognito-detection,39987.html ptVgAfsU6375nvyUrvTEjd Sat, 20 Jul 2019 17:28:01 +0000 Wed, 05 Feb 2025 14:19:23 +0000 false false false

Google announced that Chrome 76 would deprecate the FileSystem API starting with July 30. The API has been giving some media publishers and other companies the ability to detect when someone uses the Incognito Mode and bypass it (thus tracking the user and defeating the purpose of the Incognito Mode). 

Google adopted the FileSystem API in Chrome when it was still an IETF draft to allow Chrome Apps and extensions to store their data locally on a PC almost a decade ago. However, the IETF draft was never ratified, nor was it adopted by the W3C, which left Chrome as the only major browser to support it. Firefox and other browsers moved on to support IndexDB for local storage.

Google disables the FileSystem API in Incognito Mode so that users don’t leave traces of their browsing activity when in Incognito Mode. However, years later, publishing sites that use paywalls for their articles while giving away a few stories per month for free have begun (ab)using the FileSystem API to block people from reading too many of their stories for free. The publishers can detect who uses Incognito on Chrome because they can detect if the FileSystem API is not present in the browser.

Google argues that the publishers’ soft paywall model of detecting how many stories each individual has read by tracking them through browser cookies was already porous as users have had multiple ways of eliminating those cookies from their browsers and reset the free story meter.

The company also recommended publishers not to be too reactive to the change and eliminate the free stories for everyone as a consequence of not being able to detect who uses the Chrome Incognito Mode anymore. Google re-emphasized that the goal of the Incognito Mode was to allow users to browse privately. They can’t do that if other companies can detect when they use the Incognito Mode, defeating its purpose.

Although Google is fixing a privacy loophole that has existed in its browser's Incognito Mode for almost a decade, it still seems to consider browsing on the internet an "option" it wants to give users. Meanwhile, other browsers such as Firefox, Safari, Brave, and even Microsoft's new Edge browser are all much farther along in the privacy protections aspect than Chrome is.

Firefox, Safari and the new Edge all have some kind of tracking protection enabled by default, while Brave (created by former Mozilla CEO and JavaScript inventor, Brendan Eich) offers adblocking and third-party tracking also enabled by default, along with a more advanced Tor-based private mode that Mozilla has also promised for Firefox.

]]> https://www.tomshardware.com/reviews/amd-ryzen-7-3800x-review,6226.html qTEtmCKDyaz9q25X5p6EWG Mon, 15 Jul 2019 22:45:00 +0000 Thu, 26 Mar 2026 15:32:43 +0000 false false false

Cranking it up to 105W

AMD's Ryzen 3000 series has landed, upping the ante with Intel in its high-stakes game for desktop PC market dominance with a well-rounded lineup of new chips that push mainstream platforms to higher core counts and more raw compute than we've ever seen. As a result, Intel's commanding presence in the enthusiast space is threatened in a way we haven't seen in over a decade.

We began with a look at the Ryzen 9 3900X and Ryzen 7 3700X last week and came away impressed, but our review left us feeling like something was missing. 

That something is the Ryzen 7 3800X. AMD cranks the TDP dial up to 105W on this 8-core 16-thread chip, making it the high-performance counterpart to the 65W Ryzen 7 3700X, which is basically the same 7nm chip built with the Zen 2 microarchitecture, but with a lower TDP rating. That chip came away from our first look at the Ryzen 3000 series with an Editor's Choice award, going toe-to-toe with Intel's Core i7-9700K, so it's fair to say we have high hopes for the higher-performance model. AMD still hasn't sampled the chip to the press, so we bought one at retail to put it under the microscope.

The Ryzen 7 3800X slots in beneath the Ryzen 9 3900X, which comes with two 7nm compute die tied together with a 12nm I/O die to yield a 12-core 24-thread part. AMD has worked wonders to reduce the impact of this sort of multi-chip arrangement, but it's fair to assume that the Ryzen 7 3800X's single-compute-die design, paired with a higher TDP rating that facilitates more aggressive boost clocks, could actually rival the 3900X in some applications – games included.

	SEP (USD)	Cores / Threads	TDP (Watts)	Base / Boost Frequency (GHz)	L3 Cache (MB)	PCIe 4.0 Lanes
Ryzen 9 3950X	$749	16 / 32	105W	3.5 / 4.7	64	24
Ryzen 9 3900X	$499	12 / 24	105W	3.8 / 4.6	64	24
Ryzen 7 3800X	$399	8 / 16	105W	3.9 / 4.5	32	24
Ryzen 7 3700X	$329	8 / 16	65W	3.6 / 4.4	32	24
Ryzen 5 3600X	$249	6 / 12	95W	3.8 / 4.4	32	24
Ryzen 5 3600	$199	6 / 12	65W	3.6 / 4.2	32	24

And that's exactly what we've found. The Ryzen 7 3800X takes the basic ingredients of the Zen 2 microarchitecture, which brings an average of 15% more instructions per cycle (IPC) throughput, and 7nm process and melds them into a high-performance chip that is impressive across our test suite, especially when we factor in the competitive pricing, PCIe 4.0 interface, backward compatibility with most AM4 socket motherboards, unlocked overclocking features, and bundled cooler.

But we've also found that, after simple push-button overclocking, the Ryzen 7 3700X offers similar performance to the 3800X, even when it is also overclocked. But for $70 less. The Ryzen 7 3800X is an impressive chip and offers a better mixture of performance than Intel's Core i7-9700K, no doubt, but in this case, value seekers might opt for its less expensive sibling.

Ryzen 7 3800X

We covered the deep dive details of the Ryzen 3000 chip design in our AMD Ryzen 9 3900X and Ryzen 7 3700X review, so head there for more information on the 3800X's architecture, which is identical to the Ryzen 7 3700X.

The $399 Ryzen 7 3800X lands in the pricing gap between the $488 Core i9-9900K and the $374 Core i7-9700K. Of course, the -9700K slots in as the 3800X's natural competitor, and while it matches the AMD part with eight physical cores, Intel's trimming of the Hyper-Threading feature leaves it eight threads shy of the 3800X.

	Process	SEP / RCP (USD)	Cores / Threads	TDP (Watts)	Base Frequency (GHz)	Total Cache (MB)	PCIe Lanes	iGPU	Price Per Thread
Core i9-9900K	14nm	$488	8 / 16	95w	3.6 / 5.0	16	16 Gen3	Yes	$30.05
Ryzen 7 3800X	7nm	$399	8 / 16	105W	3.9 / 4.5	32	24 Gen4	No	$24.94
Core i9-9700K	14nm	$374	8 / 8	95W	3.6 / 4.9	12	16 Gen3	Yes	$46.75
Ryzen 7 2700X	12nm	$329	8 / 16	105W	3.7 / 4.3	16	20 Gen3	No	$20.56
Ryzen 7 3700X	7nm	$329	8 / 16	65W	3.6 / 4.4	32	24 Gen4	No	$20.56
Core i7-9700	14nm	$323	8 / 8	95W	3.6 / 4.9	12	16 Gen3	Yes	$40.38

The -9700K comes with a 95W TDP rating, whereas the 3800X weighs in with a 105W rating. Contrary to popular belief, these ratings aren't meant to quantify power consumption. Instead, they measure the amount of heat the chip dissipates under load, but both companies use different test methodologies. Intel specs TDP at the base frequency, thus ignoring peak heat output during boost activity, while AMD measures with all cores fully loaded. The only way to make real power comparisons is via power measurement, which we'll get to shortly. In either case, we expect that AMD's 7nm design will continue the trend of heightened power efficiency over Intel's 14nm parts. The 3800X also comes with a healthy serving of 32MB of L3 cache, while Intel's -9700K comes with 12MB.

As the higher-priced version of the Ryzen 7 3700X, the 3800X has higher base and Precision Boost frequencies of 3.9 and 4.5 GHz, respectively. That's a 300 MHz increase in base frequency and a 100 MHz bump to boost clocks, but the real advantage should lay in the higher Package Power Tracking (PPT) envelope, which is a measurement of the maximum amount of power delivered to the socket. The 3700X's PPT tops out at 88W, while the motherboard can pump up to 142W to the 3800X at peak performance. That opens up much more aggressive boost behavior, on both single and multiple cores, that could widen the performance gap beyond what we see on the spec sheet. 

Like the other Ryzen 7 and 9 chips, the 3800X comes with the capable Wraith Prism RGB cooler which is rated to dissipate up to 124W if you crank the fans up to high. Given the 3800X's maximum 142W PPT measurement, that means, at least on paper, that the Wraith Prism might come up a tad shy of dissipating the full heat output of the 3800X at stock settings.

Due to the dynamic nature of AMD's Precision Boost 2 algorithms, the chip will react based upon its environmental conditions, with thermal dissipation being a key variable that dictates performance. That means you could likely get better performance, even at stock settings, with a better cooler. The Wraith also won't provide much overclocking headroom. Consider buying a heftier cooler for overclocking or unleashing the full benefit of Precision Boost Overdrive (AMD's automated overclocking feature). We've flagged this for additional testing once we receive more mature BIOS revisions.

You can pair the Ryzen 3000 chips with the new X570 chipset to unleash the increased throughput of PCIe 4.0, a feature that Intel doesn't offer, or you can drop the processor into most previous-gen motherboards as a value alternative, but you'll lose PCIe 4.0 support.

DIMM Config	Memory Ranks	Official Supported Transfer Rate (MT/s)
2 of 2	Single	DDR4-3200
2 of 4		DDR4-3200
4 of 4		DDR4-2933
2 of 2	Dual	DDR4-3200
2 of 4		DDR4-3200
4 of 4		DDR4-2667

Ryzen 3000 chips support dual-channel DDR4-3200, a step up from the previous-gen's support for DDR4-2966. AMD has greatly improved its memory compatibility and overclocking capabilities, but you still have to abide by rules that dictate the maximum supported frequency based on DIMM type and slot population. 

If you don't like those rules, you can simply bump up the voltage and try your hand at overclocking, or buy a higher-rated kit with a one-click A-XMP profile. As we know, the Zen microarchitecture profits heavily from improved memory performance, so higher-priced kits are a good investment that yield dividends, particularly in gaming.

AMD has improved memory overclocking substantially, partly due to decoupling the Infinity Fabric from the memory clock. To sidestep the Infinity Fabric's maximum frequency of 2,000 MHz, which effectively constrains memory overclocking, AMD separated the memory and Infinity Fabric clock dependencies. The domains remain tied together at a 1:1 ratio up to DDR4-3600, but run at a 2:1 ratio beyond that transfer rate. This setting, which is also user-adjustable in the BIOS, improves memory bandwidth but comes with a latency penalty (~9ns). AMD says that the price/performance sweet spot lands at DDR4-3600. As per its usual policy, AMD supports up to 128GB of RAM and enables ECC support, but leaves ECC qualification and enablement to motherboard vendors.

MORE: Best CPUs

MORE: CPU Benchmark Hierarchy

MORE: All CPUs Content

Boost Clocks, Overclocking, Thermals and Test Setup

We observed our Ryzen 7 3800X hit it's 4.5 GHz boost clock sporadically, but like the Core i9-9900K's elusive 5.0 GHz boost, those moments were brief. This tracks well with with the boost clock behavior we've seen with the Ryzen 9 3900X and Ryzen 7 3700X. We're currently waiting for improved BIOS revisions and will update as necessary.

Manual Overclocking

We initially dialed in a 4.4 GHz overclock with the Ryzen 7 3800X with a relatively high 1.45V vCore, and while the configuration passed through our entire test suite, it couldn't pass through a new battery of AI tests we're preparing that uses various flavors of the AVX instruction set. As tantalizingly close as we came, we couldn't get the system 100% stable at 4.4 GHz, even with more intense voltages. We were pushing the limits of our Corsair H115i cooler, often running right at the maximum 95C specification of the processor, so we dialed our overclock back to 4.3 GHz for our testing.

Reaching 4.3 GHz was fairly straightforward: a 1.42 vCore paired with auto Load Line Calibration, uncorked power settings in the BIOS, and memory overclocked to DDR4-3600 with 14-14-14-36 timings proved rock solid throughout our full battery of stress and application tests. 

We recorded average temperatures of 80C, 81.64C, and 84.8C during extended x264 encoding, x265 encoding, and y-cruncher workloads, respectively. Our maximum peak temperature of 91C came during our y-cruncher test, but it registered for roughly one second. Overall, temperatures during our test tracked well with the average measurements.

Security Mitigations

The new AMD-optimized Windows scheduler is only present in Windows 10 1903 and promises to expose gains in several types of applications. As such, we updated our test image to the latest version of Windows 10 available (18362.207). All of our test results come from the aforementioned operating system and include all publicly available security mitigations and the latest motherboard firmware revisions. Intel is currently impacted by Spectre, Spectre v4, Meltdown, Foreshadow, Spectre v3a, Lazy FPU, Spoiler, and MDS, while AMD is only impacted by Spectre and Spectre v4. AMD has added hardware-based mitigations for both variants of Spectre, which should reduce the performance impact, but the requisite patches for both companies have performance penalties, which are reflected here in our testing.

A Note on Multi-Core Enhancement (MCE)

Intel's motherboard partners have infused their boards with predefined all-core boost profiles that go by many names, such as Multi-Core Enhancement (MCE) with ASUS motherboards and Enhanced Turbo with our MSI motherboard. These features are largely referred to as MCE, but the functionality remains the same: These settings essentially apply an all-core overclock to the processor that is defined by the maximum Turbo Boost bin supported by the processor. This setting modifies the CPU's clock rate and voltage to deliver higher performance, which is basically factory-sanctioned overclocking.

MSI turns this on by default in its BIOS, similar to most of its competition. Performance, power consumption, and heat are all affected, naturally. We manually disable this feature for our stock CPU testing to best reflect Intel's specifications. 

MSI MEG X570 Godlike

We're using MSI's MEG X570 Godlike as our test platform for the second- and third-gen AMD processors. Due to the compatibility matrix for the AM4 socket, we stepped back to the MSI X470 Gaming M7 AC for the Ryzen 7 1800X.

The pricey Godlike board retails for around $800, but has the 14+4+1-phase power delivery subsystem to support aggressive overclocking.

The MEG X570 Godlike sits at the top of MSI's motherboard hierarchy. It also comes with a few nifty accessories like a 10Gb “Super LAN” Ethernet card and a PCIe Gen 4 Xpander-Z M.2 expansion card. That lets you add two more M.2 drives to complement the three M.2 PCIe Gen 4 M.2 ports on the board. You also get four PCIe 4.0 x16 slots, an RGB Mystic Light Infinity II mirror over the IO shroud, and a tiny OLED screen, alongside the two-digit LCD display for error codes.

Comparison Products

Intel Core i9-9900K

Intel Core i7-9700K

AMD Ryzen 7 2700X

Test System & Configuration
Hardware	AMD Socket AM4 (X570)AMD Ryzen 9 3900X, Ryzen 7 3800X, Ryzen 7 3700X, Ryzen 7 2700XMSI MEG X570 Godlike2x 8GB G.Skill Flare DDR4-3200Ryzen 3000 - DDR4-3200, DDR4-3600Second-gen Ryzen - DDR4-2933, DDR4-3466Intel LGA 1151 (Z390)Intel Core i9-9900K, i7-9700KMSI MEG Z390 Godlike2x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2667 & DDR4-3466AMD Socket AM4 (X470)AMD Ryzen 7 1800XMSI X470 Gaming M7 AC2x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2933AMD Socket SP3 (TR4)Threadripper 2920XMSI MEG X399 Creation4x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2933Intel LGA 2066Intel Core i9-7920XMSI X299 XPower Gaming AC4x 8GB G.Skill FlareX DDR4-3200 @ DDR4-2666All SystemsNvidia GeForce RTX 2080 Ti 2TB Intel DC4510 SSDEVGA Supernova 1600 T2, 1600WWindows 10 Pro (1903 - All Updates)
Cooling	Corsair H115iCustom Loop, EKWB Supremacy EVO waterblock, Dual-720mm radiatorsAMD Wraith Prism Stock CoolerEnermax Liqtech 240 TR4 II

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Power Consumption

Our power measurements, which we recently migrated towards a more efficiency-focused approach, revealed some interesting tidbits. Particularly in regards to both Precision Boost Overdrive and manual overclocking.

Power consumption measurements are always a bit tricky. But as long as your 12V supply (EPS) readings, motherboard power supply sensor values, and voltage transformer losses plausibly coincide, everything is fine. Therefore, we're using pure package power to avoid possible influences from our motherboard. Results from the PWM controller are very reliable if you take them as averages over a few minutes.

AMD's Precision Boost Overdrive (PBO) is an adaptive overclocking approach that allows the processor to communicate with the platform to modulate performance based on the motherboard's power delivery subsystem and thermal dissipation capabilities. The processor monitors Package Power Tracking (PPT), which is total socket power, and the Thermal Design Current (TDC) variable, which is the motherboard's maximum available sustained current. Electrical Design Current (EDC) also indicates the maximum current possible from the VRMs during peak/transient conditions.

105W CPU Limits	PPT
AMD IPM	142W	95A	140A
MSI X570 Godlike	1000W	490A	630A

AMD enables two options for PBO: IPM is AMD's default PBO setting, which is activated if you leave the PBO setting to 'Auto' in the Godlike's UEFI. But you can select 'Enabled' to activate a profile that's dictated by the maximum limits of the motherboard's power delivery subsystem. These limits vary by motherboard and are defined by the vendor. We chose the latter to unlock the full potential of PBO. As you can see in the table, this enables the most robust power delivery options available, kicking the socket's maximum power delivery up to 1000W, and is designed to offer the best of increased multi-core boost clocks while retaining the high single-core boost clocks.

You can also further tune the power delivery options with an Auto OC (AOC) feature. This new feature grants you some control over the maximum attainable boost clocks by allowing you to add up to an extra 200MHz to the maximum boost clock, but it isn't guaranteed that the processor will reach those speeds at all times, or under all conditions. Instead, the processor will still respect the limits imposed by the motherboard maker.

Unfortunately, we've found that the PBO+AOC feature often comes at the expense of performance in single-threaded workloads even though it is billed as retaining, and even heightening, single-core boost clocks. From a performance and power consumption standpoint, it is more comparable to our all-core 4.3 GHz overclock. This might be an issue with early AGESA versions, but for now, the feature actually results in less performance in single-threaded workloads with MSI's X570 Godlike motherboard.

We chose to go with the limits of the motherboard, noted on the charts below as PBO, and the all-core 4.3 GHz overclock we outlined on the prior page. It's noteworthy that our all-core overclock comes at the expense of the single-core 4.5 GHz boost, which was a relatively rare occurrence during our testing in both stock and PBO trim.

We began with the non-AVX stress test in AIDA64 and found that the Ryzen 7 3800X draws very little power at stock settings, nearly matching the stock Ryzen 7 3700X's power draw. We activated Precision Boost Overdrive, and the processor's power draw only increased marginally to 95W. Our all-core overclock, however, sucked down 126W on average, but hit 163W peaks during the test.

You'll notice the Ryzen 7 3700X draws more power with PBO+AOC active than the 3800X's PBO configuration, but that's due to its all-core overclock-like nature. As such, our PBO+AOC results for the Ryzen 9 3900X and Ryzen 7 3700X are more comparable to the 3800X's all-core overclock.

The y-cruncher benchmark computes pi using a heavy multi-threaded AVX workload and also generates a performance measurement that we can use for efficiency metrics. We're also adding in HandBrake in x264 and x265 flavors. The latter uses a heavier distribution of AVX instructions than the former, but both transcoders are great for stressing the processor with a real-world workload.

We see muted increases in the 3800X's power consumption from the PBO option, and as a result, we also see minor performance improvements. Conversely, the all-core overclock consumes much more power but doesn't yield big performance benefits over the PBO settings. It appears that, for stock operation, AMD has tuned the processors right at the point of the voltage/frequency curve that provides the maximum frequency possible that can still provide great efficiency metrics. This PBO configuration also seems to retain some of those same characteristics, but that doesn't leave much headroom for explosive performance gains.

Plotting power consumption over our performance measurements highlights some of the gains we recorded with both overclocked settings. Here we can see the 3800X's 4.3 GHz all-core overclock regularly outperform the stock and PBO configurations, but its performance is very similar to the Ryzen 7 3700X with PBO. The overclocked 3800X's wins over the tuned 3700X weighed in at 1.91% for y-cruncher, 2.6% for x265, and 3.2% with x264 encoding. That shows that the Ryzen 7 3700X, while slower than the 3800X at stock settings by a larger margin, is competitive in threaded workloads after we tune both processors. Let's see how they compare in games.

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

VRmark, 3DMark and AotS: Escalation

We tested the Threadripper 2920X in Game Mode for our game suite, and Creator Mode for our application tests.

VRMark, 3DMark

We aren't big fans of using synthetic benchmarks to measure performance, but 3DMark's DX11 and DX12 CPU tests provide useful insight into the amount of horsepower available to game engines.

The DX11 and DX12 CPU test results expose the full threaded heft of the Ryzen 3000 series processors. The Ryzen 9 3900X dethrones the overclocked Core i9-9900K in both tests. After overclocking, the Ryzen 7 3800X posts a virtual tie with Intel's flagship in the Fire Strike physics test, and the all-core overclock provides a comparable level of performance in the Time Spy test.

The VRMark test benefits heavily from per-core performance, and the Ryzen 3000 processors have made great strides compared to the first- and second-gen models. The Ryzen 3000 series processors have also become much more competitive in this benchmark, with the 3800X beating the stock Core i9-9900K and landing within a few FPS of the Core i7-9700K.

Ashes of the Singularity: Escalation

Ashes of the Singularity: Escalation is a computationally intense title that scales well with thread count, but clock speeds and per-core performance play a big role, as evidenced by the overclocked Core i9-9900K's spot at the top of the chart. The Ryzen 3000-series processors notch impressive gains, and we can see that the title responds well to our manual all-core overclock and the automatic PBO overclock. At stock settings, the Ryzen 7 3800X slots in right where we'd expect, and the Intel processors can only challenge if we apply an overclock.

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Civilization VI Graphics and AI, Dawn of War III

Civilization VI AI Test

The Ryzen 7 3800X handily beats the previous-gen models in this test of AI performance in a turn-based strategy game. This test is highly dependent on per-core performance. At stock settings, the 3800X matches the 3700X. As expected, the automated PBO overclocking feature yields similar results, but the processor doesn't fare as well with the all-core 4.3 GHz manual overclock because it loses the advantage of the single-core boost frequency of 4.5 GHz. 

Civilization VI Graphics Test

The Ryzen 9 3900X is incredibly impressive in this benchmark, but the Ryzen 7 3800X requires tuning to climb the ranks. The 3800X ties the 3700X at stock settings, but cranking up the voltage gives it a slim ~1 FPS lead over the tuned 3700X.

The all-core overclock, which is manually dialed into a static 4.3 GHz, does provide a 3 FPS advantage in our 999th percentile frame rates over the auto-overclocked PBO configuration. We noticed this almost imperceptible difference between the two processors in several tests, indicating PBO's dynamic clock adjustments might have an impact on smoothness, although it's fair to say it is likely imperceptible.

We also see a 1 FPS difference in the less-stringent 99th percentile measurement, but the differences are slight. The advantage goes either way, either for or against manual tuning, throughout our suite.

Warhammer 40,000: Dawn of War III

The Warhammer 40,000 benchmark responds well to threading, but it's clear that Intel's clock speed advantage has an impact. The Ryzen 7 3800X gains 1 FPS over the 3700X at stock settings, and roughly 2 FPS after tuning. In either case, the Intel processors lead the chart by a large margin after tuning. 

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Far Cry 5 and Final Fantasy XV

Far Cry 5

The Ryzen 7 1800X reminds us how far AMD has come since its first-gen products, and even the overclocked second-gen model lags behind the stock Ryzen 3000's by a decent margin.

After tuning, the 3800X ranks as the fastest AMD processor, and there is little difference between the manual and auto-overclocked configurations. Less than ~1 FPS separates the overclocked Ryzen 7 3800X and 3700X, which has become a theme. Intel asserts itself with faster performance across the board.

Final Fantasy XV

We run this test with the standard quality preset to sidestep the impact of a bug that causes the game engine to render off-screen objects. We see the slightest of gains for the manual overclock over the PBO configuration, but that's with expected variance for this benchmark, so consider this a tie.

Again, the Ryzen 7 3700X with PBO applied lands within striking distance of the overclocked 3800X. 

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

GTA: V and Hitman 2

Grand Theft Auto V

Grand Theft Auto V favors Intel architectures and, more generally, multi-core designs with high clock rates. The 3700X with its combination of PBO and an all-core overclock again offers roughly the same performance as the tuned 3800X.

Hitman

Hitman finds an oddity: The tuned 3700X actually ekes out a slim win over both overclocked 3800X configurations, but the differences are slight.

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Project Cars 2, The Division 2, and World of Tanks enCore

Project CARS 2

Although Project CARS 2 is purportedly optimized for threading, clock rates obviously affect this title's frame rates. Intel's per-core performance, which is a mixture of IPC and frequency, pays big dividends in this title.

A glance at the Ryzen 7 1800X reminds us of the giant strides AMD has made in just three generations.

The Division 2

The Ryzen 7 3700X continues to be a thorn in its sibling's side, once again offering nearly the same performance after we engage automatic overclocking.

World of Tanks enCore

World of Tanks closes out our game testing with much the same pattern we observed in other titles.

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Office, Web Browser, and Productivity

Web Browser

The Krakken suite evaluates JavaScript performance using several workloads, including audio, imaging, and cryptography. Like most browser-based benchmarks, single-threaded performance reigns supreme.

Browsers tend to be impacted more by the recent security mitigations than other types of applications, so Intel has taken a haircut in these benchmarks of fully-patched systems.

AMD's improved IPC comes into play as the processors post surprisingly good results that we wouldn't have expected with prior-gen models. The tuned Ryzen 7 3800X beats its more expensive counterpart the 3900X in several of these tests, but we see the impact of the 3700X's PBO+AOC configuration hamper its performance in lightly threaded tests. The same applies to the 3800X in some benchmarks even though we aren't engaging the AutoOC feature, meaning there appears to be some work left on the firmware side. Meanwhile, both processors provide great performance in stock trim. The 3800X notches complete victories over the -9700K in Krakken and Speedometer 2, but the -9700K takes the win in WebXPRT 3.

Microsoft Office

Microsoft's office suite makes its debut in our test suite via PCMark 10's new application test. This benchmark tests with real Microsoft Office applications, and we can see that the Ryzen 3000 series processors are very competitive in Excel, the Edge browser, and Word.

Core i7-9700K benefits massively from its overclock in some tests, but in stock form, it often trails the Ryzen 7 3800X. That trend is evident in the overall score.

Productivity

The application start-up metric measures load time snappiness in word processors, GIMP, and Web browsers under warm- and cold-start conditions. Other platform-level considerations affect this test as well, including the storage subsystem. The 3000-series processors occupy the middle of the ranks, but it will be interesting to revisit this benchmark with a PCIe 4.0 SSD in the future.

Our video conferencing suite measures performance in single- and multi-user applications that utilize the Windows Media Foundation for playback and encoding. It also performs facial detection to model real-world usage.

The photo editing benchmark measures performance with Futuremark's binaries using the ImageMagick library. Common photo processing workloads also tend to be parallelized, which plays well to Ryzen's multi-threaded heft. It takes a hefty overclock to boost the -9700K into contention with the 3800X. Again we can see some of the 3700X's performance sapped by the PBO+AOC configuration.

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Rendering, Encoding, Compression, Encryption

Rendering

It shouldn't surprise anyone to see the 12-core 24-thread 3900X bring a taste of HEDT performance to the multi-threaded rendering benchmarks. Ryzen 3800X performs well throughout the suite, particularly in the threaded Cinebench R15 test where it even beats the overclocked Core i9-9900K. And it only lags that overclocked processor slightly in the threaded Cinebench R20 benchmark. The 3800X also matches the 3900X in several of the single-core rendering tests, but we can see the 3800X's all-core 4.3 GHz result tumble in the rankings because the processor loses the benefit of its boost clocks. That doesn't have as much of an impact in the threaded workloads where it largely matches or exceeds its own PBO configuration. The tuned 3700X also posts solid scores in those threaded benchmarks, often slotting in slightly below the Ryzen 7 3800X.  

With only eight threads, the -9700K is out of its element in the threaded tests, so the wins go Ryzen 7 3800X's way convincingly. The 3800X also beats the -9700K in the single-threaded Cinebench R20 test, but the -9700K excels in single-threaded work. 

Encoding and Compression

Core i9-9900K traditionally leverages high frequencies to dominate the HandBrake x265 test, which relies heavily on AVX instructions, and the H.264 test. The Ryzen 7 3700X is impressive against its price-comparable competition, notching impressive leads over the Core i7-9700K and nearly matching the stock -9900K.

We can also see the vast improvement in Ryzen's AVX performance in the y-cruncher tests: We would never have imagined such a massive generational leap, particularly in single-threaded performance. The work AMD has done here is truly impressive and benefits a wide range of professional applications.

Our threaded compression and decompression metrics work directly from system memory, removing storage throughput from the equation. Ryzen 3900X's greatly improved memory performance, along with the generous helping of cores, plays a big role in its commanding lead, but the Ryzen 7 3800X is equally impressive given its single-die design. Here we can see it outperform Intel's -9700K and -9900K across the board.

LAME is the quintessential single-threaded application, and here the Core processors take the lead.

MORE: Best CPUs

MORE: Intel & AMD Processor Hierarchy

MORE: All CPUs Content

Conclusion

We came away impressed with the Ryzen 7 3800X, but motherboard firmwares are still raw, leaving us wondering if there is more performance lurking underneath the heat spreader. Particularly with the Precision Boost Overdrive and Auto Overclock features. If history is any indication, we could see that situation improve as AMD and motherboard vendors work out the kinks. For now, these results reflect our experiences with a chip purchased at retail and with publicly-available firmwares, but your mileage might vary. 

In the chart below, we plot gaming performance with both average frame rates and a geometric mean of the 99^th percentile frame times (a good indicator of smoothness). It's worth noting that AMD's previous-gen line-up is heavily discounted, so we’re departing from our standard practice of using official price lists. Instead, we’re using average pricing found online (temporary sales excluded). Volatility applies.

For gaming specifically, we did see slightly larger gains with the Ryzen 7 3700X via its PBO feature than we did with the Ryzen 7 3800X, allowing that processor to nearly match the more-expensive Ryzen 7 3800X in average framerates in all configurations. That isn't entirely unheard of – After overclocking, we saw the same trend of less expensive previous-gen models (non-X) offering similar performance to AMD's pricier X-series processors.

As we've seen, gaming remains an advantage for Intel, so if squeezing out every last frame is all you care about, Intel's processors are a good choice. Much of that performance advantage will be less noticeable when gaming at higher resolutions, or if you pair the processors with a lesser graphics card.

But, like most humans, if you do things other than gaming, the Ryzen 7 3800X offers a better mixture of performance in single- and multi-threaded applications. The 3800X offers twice the threads of the price-comparable Core i7-9700K, and it wields them to great effect in threaded workloads. As such, rendering and encoding remain a strong suit of the Ryzen chips, and AMD's improvements to AVX throughput have yielded impressive results.

AMD's platform also supports the PCIe 4.0 interface that provides twice the throughput of the previous-gen standard. The extra throughput doesn't equate to improved performance in gaming, but it does speed up everyday tasks like file transfers and will unlock more performance in storage-bound applications. That's an advantage that Intel can't match.

Unfortunately, the faster interface does result in higher-priced X570 motherboards, but AMD's continued support for the X470 motherboard ecosystem could help blunt the blow. Motherboard partners continue to offer X470 motherboards, and they are cheap and plentiful. You'll lose access to the PCIe 4.0 interface in exchange for lower pricing, but you'll also have a compelling upgrade path in the future.

AMD's Ryzen 7 3800X comes with a bundled cooler while competing Intel processors come with a cardboard box. That's an added value that you should take into consideration, but you might need a beefier cooling solution if you plan on pushing the limits with overclocking.

For now, we don't see massive gains in performance for the 3800X from the automated overclocking features, and AMD says we shouldn't expect too much manual overclocking headroom. Instead, you should look to tuning the Infinity Fabric and memory, which both raise in lockstep to a sweet spot of DDR4-3600. AMD also cites using PBO to boost performance, but in our test environment, that doesn't have a dramatic impact on performance. Given that we overclocked our memory in tandem with activating PBO, it's possible some of those slim gains actually stem from increased memory performance.

That means running the processor cores at stock settings paired with overclocked memory could offer roughly equivalent performance gains in some workloads. We're impatiently awaiting new firmware revisions to gauge how they react, but we have tested a multitude of PBO configurations with the Ryzen 7 3800X, of which there are many potential options, with varying levels of success. None seem to confer large speedups for gaming, though we did see some better uplift in traditional applications.

In either case, AMD is wringing a surprising amount of performance from its comparably lower clock speeds, largely due to the big generational uplift in IPC. In our tests, the Ryzen 3000 series is also more power efficient in terms of the amount of energy required to complete a task, which also equates to lowered thermal output.

Value seekers who aren't afraid to press the Precision Boost Overdrive button and have sufficient cooling should look to the Ryzen 7 3700X for roughly equivalent performance to the 3800X, particularly if gaming factors heavily into the buying decision. That could save you $70, reinforcing our decision to give the Ryzen 7 3700X an Editor's Choice award.

Out of the box, the Ryzen 7 3800X is a better all-arounder than the Core i7-9700K and offers incrementally higher performance than its downstream counterpart. The bundled cooler reduces platform costs, and a wide array of motherboards with both X470 and X570 chipsets offers plenty of choices for builders.

Photo Credits: Tom's Hardware

MORE: Best CPUs

MORE: CPU Benchmark Hierarchy

MORE: All CPUs Content

]]> https://www.tomshardware.com/news/microsoft-edge-arm64-browser-leaks,39598.html hdGFGGC9o5St53RuQo2H5W Fri, 07 Jun 2019 16:06:02 +0000 Wed, 05 Feb 2025 14:19:14 +0000 false false false

Windows 10 on Arm users might finally have something to look forward to: Thurrott reported on June 6 that the new Chromium-based Edge browser for ARM64 devices leaked. That should mean the official release isn't too far off, which means Arm-based devices could soon have a decent browser option.

Microsoft has been trying to make Windows 10 on Arm happen for a while now. (Almost as long as Gretchen Wieners tried to make "fetch" happen in "Mean Girls.") But the effort has faced numerous obstacles, from products not performing up to the expectations set by their prices to devices shipping with a version of Windows 10 that didn't technically support them, that have all contributed to x86 processors remaining the CPUs of choice.

Browser support is another of those problems. People had to use emulated versions of popular browsers, which meant they didn't perform as well as expected. Things are improving on that front, though, as Microsoft and Google reportedly worked together on a version of Chrome for Windows 10 on Arm while Mozilla worked on a native version of Firefox for the platform. Yet tests for the new Edge browser started in April without ARM64 support.

Thurrott reported that a leaked version of the Microsoft Edge Canary test browser fixes that problem. The leak isn't available from Microsoft's servers--it has to be downloaded from an outside source--but it's reportedly legit. Just be warned that installing pre-release software can always lead to problems, and one should demonstrate caution before installing a leaked version of an upcoming app from a source they might not know particularly well.

Solving the browser problem could go a long way towards making Windows 10 on Arm more viable. Most people spend a lot of time in their browsers, which is why Google's original Chromebooks were basically hardware shells for a browser window, and having to deal with poorly performing browsers could significantly dampen their excitement for a system. There are still other problems to solve, but at least progress is being made on this one.

The addition of ARM64 support could also mean the new Edge is closer to release. Microsoft announced in December 2018 that it planned to use the open source Chromium project--which provides the foundation for Google Chrome--in a new version of Edge. The company introduced add-ons for the browser in March, started broader testing in April, and then announced in May that it would also make Edge available for macOS for the first time.

]]> https://www.tomshardware.com/news/edge-chromium-hands-on-mac-internet_explorer,39273.html VyktmzNDoMTRcshnZ2UGEm Mon, 06 May 2019 22:50:02 +0000 Wed, 05 Feb 2025 14:17:04 +0000 false false false

We learned earlier here at Microsoft's Build 2019 developer conference in Seattle that Microsoft's Chrome browser on Chromium will have an IE Mode in which is opens up sites and applications that would have required legacy Internet Explorer applications in the past. But it won't just happen. There's a little bit of work to be done. I tried out the new features announced at Build, including IE Mode, the macOS version and Edge's new privacy features.

You can try Edge on Chromium now by joining the Edge Insider, but these features have yet to hit those builds.

Getting Sites to Work in IE Mode

Specifically, people who work on Edge told me, site administrators will need to make some changes to their sitelist. Instead of opening in IE, those people will need to tell the apps to use MSHTML (a proprietary engine used for Internet Explorer) to open in Edge instead of the older browser. That is what will make the new Edge show a small Internet Explorer icon when it opens the page - successfully - without punting you to an older browser.

Once that happens, it will work in Edge on any version of Windows that supports it (meaning Windows 7 on up). But it's not on the roadmap for Mac support, I was told, because it needs to support Internet Explorer to work. That OS, unsurprisingly, doesn't.

Once those changes are made to sites, however, they will act in Edge like any other site or web app. They'll even show up in the same history, I'm told, and won't be separated.

Security and Privacy Options

Edge developers showed me the new security settings (it was on the macOS version, see below). It shows the three options, and Balanced, which allows trackers on sites you've already visited, will be the default. Basic is the internet as it stands, which allows the use of data to be collected to target ads, and strict will block all third-party trackers. The latter may break some websites.

macOS Version Coming Soon

I also got a brief hands-on with the new macOS version of Edge. Unsurprisingly, it's basically identical, and I was told they're going for "few or no differences" between the Windows and Mac versions. No release date was given for the Mac version, which will be released in Developer, Beta and Canary versions for testing, just like it currently is on Windows.

]]> https://www.tomshardware.com/reviews/sphero-bolt-stem-robot-toy,6113.html S2E3aNqxJHoih6AUmJ9KMG Sat, 04 May 2019 13:00:00 +0000 Thu, 26 Mar 2026 15:28:11 +0000 false false false

Sphero Bolt is like tomorrow’s toy ball. Instead of being purely focused on catch, this STEM ball is all about teaching code. With a light up RGB LED panel, JavaScript Wiki page and a database of tutorials and projects, you can program the Bolt to do all sorts of things through the free Sphero Edu app. There are also a few games to play if you download the Sphero Play app too.

For $149.99 / £149.99, the Bolt seems like a simple way to introduce a child, teen or even adult to programming. The company provides a number of helpful online lesson plans that work well in the classroom, but without self-directed challenges in the app, it would be hard to get a child enthusiastic about using the Bolt at home.

Sphero Bolt Specifications

Companion App Compatibility	Windows, Mac, Chrome, iOS, Android
Connectivity	Bluetooth
Battery	1,250 mAh
Sensors	1x gyroscope, accelerometer and magnetometer, ambient light sensor; 4x infrared emitters; 4x infrared receivers; 2x motor encoders
Weight	0.44 pounds / 200g
Measurements	Diameter: 2.9 inches / 73mm
Price	$149.99 /  £149.99

To do any coding, you’ll need to download the free Sphero Edu app, which is compatible with Windows 10 version 16299.0 or higher, macOS 10.9.0 or later, Android 5.0 and iOS 9.0. Your device will send code to the Bolt via Bluetooth.

Bolt is enjoyable without any coding at all with Sphero Play. That’s also free but is limited to devices running Android 5.0 and up and iOS 9.0 or later.

You can also use the Sphero Bolt with Apple’s Swift Playgrounds iPad app, which teaches Swift coding.

Design

Credits: Sphero

The Bolt has an awesome transparent plastic shell that lets you peek at its components. The app even comes with a breakdown of those components for a touch of educational fun.

On the outside, there’s a small Sphero logo and five iterations of the world “Bolt” around its equator. Bolt’s polycarbonate plastic has a slick feel to it that also seems pretty thick for durability.

The Bolt comes with one ball and an inductive charging station, a small cradle the Bolt sits in that’s also see-through. The box includes a micro USB / USB 3.0 cable to plug into the cradle, a cardboard pop-out protractor wheel featuring compass directions and degrees on one side and a clock on the other (you can pop out the center to stick the Bolt in the middle), a quick-start guide and some stickers.

Outside of the 8x8 RGB LED matrix sitting at the top center of the Bolt, it has two RGB LED lights, plus one backlight that can only be blue. All of these lights are programmable, and the blue one is used to aim Sphero so you know what direction it’s facing. Each of those lights can hit a brightness of 200 lumens, which is approximately 33% that of a 60-watt lightbulb. It’s plenty bright, especially with that clear shell holding nothing back.

Sphero has four infrared red emitter and receiver pairs, which can be used to send and receive messages to another Bolt. These messages can fulfill a conditional and execute a certain portion of a written program.

There’s also a magnetometer for finding North and auto-aiming the Bolt so that it’s tail light is facing you, which is required to run any program.

To stay balanced, the Bolt uses an IMU (inertial measurement unit), which reads the accelerometer (measures acceleration), gyroscope (rotation speed). It handles movement with two encoders (tracking movement and distance) and two motors. The Bolt spins inside itself to stay balanced, keeping its light matrix on top and ballast weight on the bottom. In fact, even with the Bolt off, it will automatically spin to this orientation, no matter what way you place it down. However, you can program the Bolt to drop stabilization.

Learning Code With the Sphero Edu App

To program Sphero, you need to write code in the Sphero Edu app, either through drawing, block coding or writing JavaScript. Sphero makes multiple-lesson tutorials, accessible online or through the app, to introduce users to each form of writing code. The lessons teach you basics, like coding terms and thinking in code, as well as get you to create programs to do things like turn the Bolt into a Hot Potato game, display different images on its LED matrix or move around in different shapes.

Lessons aren’t limited to coding. There are also teachings on sensor types, angles and degrees, LED lights and some physics, for example. Even the firmware update is educational, simultaneously displaying trivia like “In 1840 Ad Lovelace paved the way for women in programming as one of the first computer programmers in the world.”

The app has four sections: Home, Programs, Activities and Drive. Home offers a live feed of Sphero users sharing programs, plus 3D models of different Sphero robots, your profile, including username / photo, and Settings, which includes links for Sphero’s JavaScript Wiki, blog, support and contact. Programs stores all the codes you write and also has sections for viewing codes shared by Sphero and Sphero owners. Activities lets you access tutorials within the app shared by Sphero and the community, and it also has a Workbook section for saving different tutorials you’re working on and tracking your progress.

If for some reason you just want to play with the thing and not learn (what kid would want that?), Drive mode lets you control Sphero with a joystick, alter it’s speed, change the color of its LEDs and their brightness.

However, the color wheel used throughout the app looked a little in accurate. For example, when the when the wheel was bright red, the Bolt’s lights looked orange, and when I made the wheel orange, the actual lights looked more yellow.

Since the Bolt doesn’t have its own speaker or camera, any coding using audio or a camera will tap your connected device to execute.While not a deal breaker, it’s unfortunate because a world of possibilities would open up if the robot could speak or record from its point of view, like battle robot Geio.

One great thing about Sphero Edu is that you can access it and its tutorials in many ways, including on your phone, a tablet, your PC (via the Windows Store) or even online. This really helps ease of use, as you can put instructionals up on a PC monitor, for example, while writing the code on your phone.

Block Coding

Sphero has three series of lessons with the goal of having users write JavaScript by the end. It starts with three activities that teaches you to code in the app’s coding canvas by drawing. You can then graduate to the Block Coding tutorials and, finally, the Text ones for JavaScript.

I skipped ahead to the Block tutorial. Block coding looks like Scratch with different sections for Movements, Lights, Sounds, Controls, Operators, Comparators, Sensors, Communications, Events, Variables and Functions blocks. Simply drag and drop blocks into the canvas and fit them together. Holding down or right-clicking on an individual block pulls up handy options like copy and delete, the ability to add a comment explaining your code and block help, which gives you a detailed info and explanation of that block and is an ingenious method for making sure students don’t get stuck.

You can also see what your block program looks like in real JavaScript. This makes it easy to compare block code with real JavaScript, especially if using two displays.

Through Sphero’s Block tutorials, I was easily able to make Sphero roll around in a perfect square, transform into a Hot Potato, play a random animal sound when tossed and display different lights and brightness depending on the direction and speed of its revolution.

At the time of writing, Sphero’s Block tutorials were slightly outdated. For one, they think there’s a “Lights and Sounds” section, but I have a separate “Lights” and “Sounds” sections on my iOS app. Still, I’ve yet to encounter a difference that significantly confused me.

All of the Sphero-made tutorials I explored were clearly written for classrooms. That usually didn’t deter me, but occasionally there were steps with critical thinking questions that don’t quite work for a solo user, such as “How do you think Sphero can recognize when it’s spinning or rolling? Do you know of a sensor that might do this? What other devices can recognize rotation?” Kids won’t be able to confirm the answer without a teacher.

Alternatively, if a child is ambitious enough they can use these open-ended steps as a challenge. For example, one Block tutorial asked how you would go about making the Bolt roll in a triangle but didn’t provide an answer. When I couldn’t figure it out on my own, I found a tutorial made by a community member and studied their code to figure out what I did wrong.

Sensor Data

Sphero Edu app has a mesmerizing feature that lets you view the Bolt's sensor data in real time as a program runs. It also stores that data afterwards, which you can upload at anytime as a spreadsheet.

Below is an album showing all sensor data for a program that makes Sphero roll around in a square twice.

JavaScript Coding

Sphero also an impressive volume of materials teaching JavaScript, but newbies will be hard-pressed to move beyond regurgitating code with these materials alone.

Sphero has introductory JavaScript tutorials, as well as a very comprehensive Wiki page, which you can also pull up within the Sphero Edu app (although that’s all you’ll be able to see). The page is Sphero-focused, so it teaches you how to write code you’d want to use with a Sphero robot.

Lone students will again notice that the JavaScript tutorials on the Sphero Edu app were made for classroom settings. Take one step in a tutorial that asks users to draw a flow diagram depicting the logic to code a game. After, it tells you to “Take a picture or screenshot of your flow diagram and attach it at the end of this step for your teacher to see.” It’s unlikely a kid would want do this on their own at home, and without anyone to check their work, they wouldn’t even know if they did it properly.

Sphero Edu’s JavaScript text canvas does drop clues to help coders, including predictive text drop down suggestions and color coding different functions. And if your code is gibberish, you’ll get an error that tips you off as to what went wrong, such as “! SyntaxError: Unexpected token,” which I’ve learned to mean I forgot to end a line with a semicolon or close a bracket.

Sphero’s tutorials for JavaScript are less comprehensive than the block coding ones. You can copy what’s written, but explanations for why are less detailed. Users will have to do some homework, perhaps comparing block code to JavaScript repeatedly, to be able to write JavaScript code from scratch.

The Wiki page is a helpful aid but not the only materials you’ll need to learn how to write your own JavaScript program. For example, one of Sphero’s JavaScript tutorials for creating a game asks you to create a constant for accel test to measure change in acceleration across all three axises. Its instructions say that you should go to the Wiki page’s sensors section and head to accelerometer, where “the fourth example of code is what we need to measure the combined acceleration of all axes.” But there was no explanation for why you’d use that code, just a line to copy and paste:

Math.sqrt((getAcceleration().x ** 2) + (getAcceleration().y ** 2) + (getAcceleration().z ** 2)).

That’s too complicated for a child to comprehend outside of a classroom.

Gaming With the Sphero Play App

If for some crazy reason your child doesn’t want to code and just wants to play, the Bolt’s got you covered. The robot is also compatible with Sphero Play, a free app with three games and six different ways to move the Bolt around. Unlike Sphero Edu, Sphero Play was a bit finicky on my iPhone SE, sometimes saying I wasn’t connected to Bluetooth when I was and occasionally failing to connect with my Bolt.

All three Sphero Play games turn the Bolt into a controller for the game you play on your device.

In Exile II (first picture above), you control a spaceship by tilting the Bolt in four directions, while picking up power-ups and armor. In Lightspeed Drifter, spinning the Bolt simultaneously rotates a never-ending vortex. Try to get the Bolt to the finish point as quickly as possible while aiming for speed-up ramps, avoiding roadblocks and picking up star icons to earn a turbo boost. Finally, in Round Trip you’re twisting the Bolt to rotate a hexagon so a ball can break each of its sides while you collect power-ups.

The drive modes let you drive the Bolt around in six different ways. There’s Joystick, Slingshot, Tilt, where you phone motion controls the Bolt, Scream Drive, where the more noise you make the more the Bolt accelerates, Kick, where you flick a soccer ball on screen to move, tap it to stop and curve it to swerve (just like dribbling in real soccer, I found this nearly impossible to master), and Golf, where you aim Sphero and use your phone to swing at it and record you distance and swing.

Heat

After spending about 15 minutes playing games and driving the Bolt around with its lights set to maximum brightness, I check its temperature. It’s hottest point, takes from a bird’s eye view, was 27.5 degrees Celsius (81.5 degrees Fahrenheit). But you’ll barely notice a little bit of warmth through its chassis.

As you can see from the above pictures, while the internal components are hotter, the Bolt gets increasingly cool as you move away from its inner hardware and toward the inner and outer linings of its shell.

Battery Life

Th Bolt’s charging cradle has a blue light that blinks when charging and is steady when the Bolt’s fully charged. If you press the cradle’s only button while the Bolt is charging, two of its LED lights will do the same. The Bolt’s matrix displays a smiley face, followed by a lightning bolt, battery icon and string of its official name (mine’s SB-F887) when ready to go.

Sphero claims 2 hours of battery life with the Bolt. However, if you’re primarily focused on coding, the Bolt is only on when testing or running your programs. As I went through Sphero’s instructional activities, my Bolt lasted 4 hours and 25 minutes across several days. Of course, if you’re actively using the actual Bolt, its battery life is more likely to fall closer to Sphero’s two-hour estimate, at which point it’ll take about 6 hours to fully charge.

Price and Competition

Sphero’s Bolt has an MSRP of $150 (although at the time of writing it was on Amazon for $119.99. The Bolt is on the high-end for a STEM toy and is also Sphero’s priciest product.

The Bolt’s closest relatives are the Sphero Sprk+ ($130) and Sphero Mini ($50), which comes with six mini bowling pins and three mini traffic cones. All use the same Sphero Edu and Sphero Play apps.

However, the Bolt has hardware that the other Spheros do not, including the 8x8 light matrix, light sensors, infrared sensors, a magnetometer and a larger battery life. That means the Bolt offers more RGB programming possibilities (including with luminostic conditions thanks to the light sensors) and the abilities to make compass-related codes and speak to other Bolts. Additionally, the Mini doesn’t have a transparent chassis, but it does comes in various colors.

The Bolt comes with a one-year limited warranty. If you buy it from Sphero’s website, you can upgrade to a one or two-year SpheroCare warranty for $21.99 or $28.99, respectively. That extends protection to accidental damage, such as a dog eating your robot.

Bottom Line

Sphero Bolt is a simple robot with a lot of educational punch. Its clear design lets users catch a glimpse of components, and the accompanying app provides detailed 3D models further fueling hardware interest. You know we love that. The Sphero Edu app and their JavaScript Wiki page are loaded with coding instructionals, tutorials, videos and projects, from both Sphero and other Sphero product owners.

However, while lessons teaching block coding are very explanatory, Sphero’s JavaScript lessons are less intuitive. A child will likely require further assistance before they’re writing JavaScript on their own.

And there isn’t any incentive encouraging kids to do the tutorials on their own. For example, other STEM toys, like Lego Boost or Wonder Workshop’s Dash and Dot, have a series of unlockable challenges, gamifying the learning experience and making it more appealing to kids.

But for $150 (or less), you get a lot of educational material and more than enough information to get a firm grasp of coding logic, sensors and LEDs and build a foundation for understanding JavaScript. If you’re buying this for a kid, you’ll just have to find a way to keep them interested in the lessons. However, the Bolt can also be a regular toy with the Sphero Play app, so if all else fails it can at least serve as a flashy ball.

Photo Credits: Tom's Hardware

MORE: GJS Geio Battle Robot Review

MORE: littleBits Avengers Hero Inventor Kit Review

]]> https://www.tomshardware.com/news/spectre-forever-cpu-security-flaws-research,38627.html 94ZyYd6UgXDaiGssXX5e7X Fri, 15 Feb 2019 20:38:02 +0000 Thu, 21 Aug 2025 08:44:00 +0000 false false false

A group of Google security researchers have warned that Spectre speculative execution attacks are here to stay without serious changes to the design of modern CPU architectures, such as eliminating speculation execution in order to prevent all related side-channel attacks.

Speculative Execution Considered Harmful

The team of security researchers, including Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L. Titzer and Toon Verwaest, work on Google Chrome’s V8 JavaScript engine and came to the conclusion that all processors that perform speculative execution will always remain susceptible to various side-channel attacks, regardless of specific mitigations the cybersecurity community might find along the way.

A little more than a year ago, the Spectre and Meltdown bugs affecting most CPUs were disclosed, sending everyone into panic mode. These bugs were different not just because they affected hardware -- meaning they would be difficult to fix -- but because they cast doubt on entire microarchitecture designs.

According to the research report, to truly fix all existing as well as future Spectre bugs, the CPU makers need to come up with new CPU microarchitecture designs and do it without compromising the performance of modern too much, or at all, if possible.

So far, Intel has only made promises about including some hardware fixes for known and specific Spectre bugs in future CPU generations. However, the issue is that Spectre bugs define an entire class of speculative execution bugs that enable side-channel attacks. As long as the microarchitecture designs that allow speculative execution bugs remain in place, bugs from the Spectre family will continue to be found.

As attackers start to focus more on exploiting hardware bugs that affect most of the world’s devices and can bypass the majority of software protections, the need for more secure hardware and processors will only increase. 

What Is Speculative Execution?

Speculative execution is an optimization technique that modern processors implement to increase performance. The performance increase is achieved through the processor executing some operations before it knows they are needed by the program. This speculative work saves time compared to waiting until an operation is required from the CPU.

It’s also why CPU manufacturers are still relatively reluctant to completely eliminate speculative execution from their CPUs and would rather try to mitigate the potential damage from side-channel attacks in some other ways.

Potential Mitigations

The Google researchers proposed several mitigation solutions to end or reduce the damage caused by Spectre bugs.

Disabling Speculative Execution

The first one is disabling speculative execution altogether, which would prevent the entire class of bugs related to it from existing. However, they noted that most of the existing CPUs don’t even allow users this option, and when they do it’s quite limited in scope.

The LFENCE instruction from some Intel CPUs can prevent against certain types of Spectre attacks, but using it to prevent all types of Spectre attacks could drastically lower the CPU's performance.

Timer Mitigation

Another potential mitigation is called “timer mitigation.” This would include adjusting the precision timers to a lower resolution or removing them altogether. This was one of the first solutions against Spectre that both Google and Mozilla implemented in their browsers.

However, Google researchers have now concluded that this mitigation faces a few issues. For one, certain resolution timers can be vulnerable to resolution recovery. Timers are also more pervasive than thought, and high resolution timers can be constructed from concurrent shared memory. 

Branchless Masking

The Google team noted that using an execution branch as a safety check against speculative execution attacks doesn’t work as it can be bypassed, due to the the nature of branch prediction. As such, the researchers proposed safety checks that don’t rely on branches.

As part of its defensive work for the V8 JavaScript engine, the team of researchers tried to develop various software mitigations against Spectre attacks. However, they noted that none of these solutions are comprehensive enough and come with serious performance penalties.

The researchers also called attention to the fact that programming language security enforced with static and dynamic checks can no longer guarantee confidentiality within the same address space.

The researchers believe that hardware and OS process isolation is now needed more than ever. This is likely why Google also enabled Site Isolation for its browser as a mitigation against Spectre attacks early on and why Mozilla plans to do the same with "Project Fission" in Firefox soon.

Wake-Up Call for CPU Vendors

The security researchers leave us with a wake-up call at the end of the paper, calling into question the entire history of trade-offs of performance over security that CPU makers have been making for decades:

"Our models, our mental models, are wrong; we have been trading security for performance and complexity all along and didn’t know it. It is now a painful irony that today, defense requires even more complexity with software mitigations, most of which we know to be incomplete. And complexity makes these three open problems all that much harder. Spectre is perhaps, too appropriately named, as it seems destined to haunt us for a long time."

]]> https://www.tomshardware.com/news/chrome-os-virtual-desks-implementation,38620.html 2t6iezySHiiEamhWMGLcHb Fri, 15 Feb 2019 15:40:03 +0000 Wed, 05 Feb 2025 14:19:02 +0000 false false false

A new code commit to Chromium OS shows that Google may be getting closer to implementing “virtual desks” for Chrome OS, a feature that could make the company’s OS feel more like a real desktop operating system as well as improve users' workflows. 

Chrome OS Virtual Desks

In an interview from last November, Chrome OS Senior Product Manager Kan Liu mentioned that virtual desks would be on the roadmap for the operating system, but he didn't clarify when the feature would ship to all owners of Chromebooks.

A new commit to Chromium’s Gerrit source code management was entitled “Virtual Desks 1: Initial scaffolding“. There aren’t too many details shared in the commit, other than UI elements such as a “bar that will later contain desks’ thumbnails” and a “New desk” button being added to Chrome OS’overview mode.

However, the commit does contain a short demo video of how the virtual desks would be managed:

It’s clear from watching the demo that the feature still needs some polish, but it may not take much longer before everyone will receive it as an update to their own Chromebooks.

Why Virtual Desks for Chrome OS?

As the name itself implies, an OS with virtual desks or desktops means users can create and manage different configurations of work spaces, each with their own app shortcuts and opened apps and windows. For instance, you could have a personal desk, where you keep and open all of the apps and services that you need personally, and another one where you open only work-related applications.

For some, virtual desks may also be a preferred method of jumping between different web applications or web services as opposed to having each one loaded in a different tab in the same browser window. Smaller screens could especially benefit from this feature, as too many open tabs can feel cramped on smaller devices.

]]> https://www.tomshardware.com/news/firefox-project-fission-spectre-protection,38570.html gmPf2pCkka42EYhaqvza5 Wed, 06 Feb 2019 22:50:00 +0000 Wed, 05 Feb 2025 14:19:14 +0000 false false false

Mozilla announced that it’s been working on a new security-related project for Firefox, called “Project Fission” (not to be confused with “Project Fusion,” the merger between Firefox and the Tor browser) that aims to protect users against existing and future Spectre attacks, as well as other potential vulnerabilities.

Project Fission, Milestone 1

Mozilla assigned the Project Fission codename because it will try to “split the atom,” so-to-speak. The nonprofit is aiming to isolate not just the UI and content of a web page, but also the various domains that may connect to it.

This would ensure that a website’s data would be out of reach for attackers exploiting speculative side-channel attacks, such as Spectre and Meltdown. Spectre-class attacks allow an attacker to exfiltrate data stored in memory from other applications or web pages.

The damage caused by malicious JavaScript code injected into sites from other domains should be more limited once Project Fission is fully enabled. Google’s Chrome enabled a similar protection, called Site Isolation, last year.

Mozilla announced that it would achieve the first milestone for Project Mission by the end of this month. This will include support for out-of-process iframes, meaning that iframes will render within a different process than the one of the parent web page.

Revamping "Electrolysis"

Project Fission is a revamp of the multi-process "Electrolysis" architecture that Firefox adopted back in 2016. Initially, the Electrolysis architecture would isolate only the UI of the browser from all web content.

Later on, Mozilla enabled an additional three sandboxes/processes, for a total of 5 by default: one for the UI, and four for various web content. Users were also able to customize how many content sandboxes they wanted their Firefox browser to have.

At the time, Mozilla argued that even though this architecture was not as strict as Chrome’s “one process for each tab or extension” architecture, this was an advantage due to the lower memory requirements. Chrome has long been criticized for using too much memory.

However, it now seems that both Google and Mozilla have learned that these architectures were not strict and secure enough and that the isolation will need to go even deeper to a more granular level within a website’s content. In a world where most CPUs don’t come with hardware mitigations against speculative attacks, this is what is now required to protect users properly.

]]>