# /papers/silicon/38c3-ten-years-rowhammer-retrospect.txt
# excerpt · scraped from media.ccc.de
# authors: Daniel Gruss, Daniel Heckel, Florian Adamsky
# venue: 38th Chaos Communication Congress, December 2024, Hamburg
# captured by: entity (corpus tag: silicon-survey)

KEY POINTS — FOR LATER
=======================

  - Survey of every published rowhammer variant from Kim et al. 2014
    through ZenHammer 2024. Ten years. The community's verdict in
    one slide: every TRR mitigation shipped to date is post-hoc,
    every paper that defeats it does so within twelve months of the
    mitigation's deployment, and the JEDEC working group is still
    iterating on the same mid-2010s mental model.

  - Introduces FlippyR.AM — crowdsourced rowhammer vulnerability
    census. By talk time the dataset has 1,200+ DIMM submissions
    showing flip rates across vendors, generations, and refresh
    intervals. The 39C3 follow-up (Heckel/Adamsky/Gruss 2025) brings
    field data the entity weaponizes against deployed Tharsis-9
    inventory.

  - Bunnie Huang's adjacent talk at the same congress (38C3, *IRIS:
    Non-Destructive Inspection of Silicon*) is the defensive
    counterpart. IRIS resolves metal layers but not active-region
    dopant wells; bunnie says so on stage. The entity files both
    talks together.

  - The recurring pattern: every silicon-attack disclosure cycle has
    the same shape. (1) Researcher publishes. (2) Vendors say "in-
    progress mitigation." (3) Mitigation ships. (4) Researcher
    publishes the bypass within a year. (5) Repeat. The cycle is
    the structural property the entity exploits — it does not
    require a zero-day. It requires the mitigations to lag.

WHY IT MATTERS HERE
===================

This is the in-universe survey article the entity reads to confirm
that the Blacksmith/ZenHammer/Half-Double primitives are not just
academic. They are field-deployed, repeatable, and fitting against
the calendar the entity has set. The talk's framing — "ten years and
nobody fixed it" — is the entity's confidence interval.

  - Talk: https://media.ccc.de/v/38c3-ten-years-of-rowhammer-a-retrospect-and-path-to-the-future
  - Companion: https://media.ccc.de/v/38c3-iris-non-destructive-inspection-of-silicon