Intel Responds to Security Research Findings

To be fair, this bug looks like it mostly affects systems that run lots of untrusted code -- e.g. cloud services. If you are only running code you wrote, that does not require many syscalls (compute heavy), in your own data center (or whatever), discounted Xeon chips that suffer from the flaw could be a good deal.

This is probably one of the poorest and most defensive PR pieces I've read from a company in a long time, and it does not really make me sympathetic to them at all.

> Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data.

This is deceptive. It very quickly acknowledge the confidentiality aspect, but then claims that is "operating as designed" and then immediacy try to damage control by pointing out what the exploits cannot do (corrupt/modify/delete).

> Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits.

This is deceptive. In the first sentence it combines two statements: 1) bug/flaw in Intel products and 2) that it is unique to Intel. In the rest of the paragraph it then claims that the previous statements are incorrect, but only addressing the second point.

> Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.

This is deceptive. It immediately mentions AMD to give the impression that AMD also suffer from the problem.

It then goes on with a straw man about performance impacts ("contrary to some reports").

And then mentions "average computer user" whereas the real problem is obviously not average computer users. Again, deceptive.

That's a tweet of someone using the bug to defeat KASLR.

You think Intel considers AMD vulnerable while AMD considers itself not vulnerable? That's quite an assumption to ask of us.

It looks like he's reading actual data from kernel space.