Meltdown, aka “Dear Intel, you suck” • Hacker News Board

Re: Meltdown, aka “Dear Intel, you suck”

#121

Post by JdeBP » Sat, Jan 06, 2018, 4:51 PM UTC

kuschku wrote: post #42

blattimwind wrote: post #8

Earlier quoted context omitted.

No one seems to have told the other BSDs, either.

FreeBSD was told in December, which is still a realistic timeline.

Late December, i.e. a week or so before the cat actually got let out of the bag, and probably around a fortnight's notice until the originally planned coördinated announcement date.

* https://news.ycombinator.com/item?id=16074531

That is hardly enough time, considering that it is likely a holiday period for most of the people concerned, to prepare what needed to be prepared. Google and Intel gave themselves six months, in contrast, and they gave Ubuntu since November 2017.

I still haven't nailed down how much advanced notice Matthew Dillion, author of DragonFly BSD, was given; although his apparent level of preparedness with patches on 2018-01-05 can be attributed to the fact that he actually talked publicly about the problem in April 2017, months before Google Project Zero secretly reported it to processor manufacturers in June 2017 in the first place.

* https://news.ycombinator.com/item?id=16084641

Re: Meltdown, aka “Dear Intel, you suck”

#122

Post by tokenizerrr » Sat, Jan 06, 2018, 4:52 PM UTC

tomkat0789 wrote: post #87

Hi I'm a mostly average Linux user just now learning about these hardware vulnerabilities as I'm planning on building a new computer. What new processor should I buy that has the best chance of being safe when all this dust clears? I first posted this question on a thread about Intel ME. Have processors always been this tricky security-wise or are these low level exploits we're finding a recent phenomena?

Wait a few months if you can.

Re: Meltdown, aka “Dear Intel, you suck”

#123

Post by dk1138 » Sat, Jan 06, 2018, 4:54 PM UTC

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

You have a lot of good points. I think it's just as fair to say that if Intel were to foster real conversation and not just fire up the PR monster there'd be less outrage.

Re: Meltdown, aka “Dear Intel, you suck”

#124

Post by loeg » Sat, Jan 06, 2018, 4:57 PM UTC

> Personally, I do find it....amusing? that public announcements were moved up after the issue was deduced from development discussions and commits to a different open source OS project. Aren't we all glad that this was under embargo and strongly believe in the future value of embargoes?

This is a bogus criticism. The issue was successfully embargoed for something like six months(!) before being published a week early.

Re: Meltdown, aka “Dear Intel, you suck”

#125

Post by stanleydrew » Sat, Jan 06, 2018, 4:57 PM UTC

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

I am also increasingly desperate for an internet place to read and discuss things in good faith. When HN started to go downhill I shifted to Twitter, but Twitter is like poison.

Perhaps we can create a new place?

Re: Meltdown, aka “Dear Intel, you suck”

#126

Post by drdeadringer » Sat, Jan 06, 2018, 5:02 PM UTC

stanleydrew wrote: post #125

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

I am also increasingly desperate for an internet place to read and discuss things in good faith. When HN started to go downhill I shifted to Twitter, but Twitter is like poison. Perhaps we can create a new place?

Could you estimate for us when "HN started to go downhill"?

Re: Meltdown, aka “Dear Intel, you suck”

#127

Post by 549362-30499 » Sat, Jan 06, 2018, 5:04 PM UTC

discoursism wrote: post #115

krapp wrote: post #103

Earlier quoted context omitted.

>I just wish there was just some corner of the internet where this wasn't the dominant trend and I had hoped it was here on HN You're not going to find that, because taking the path of least intellectual and emotional resistance is just human nature. There is a positive feedback loop with outrage narratives that feeds people's ego and sense of in-group superiority, where one either feels empowered by agreement, or fe…

Metafilter seems to be better about this stuff than we are here. At least, whenever I read it, the responses seem more thoughtful.

I agree, but Metafilter is extremely heavily moderated and there is a (small) cost to get privileges to comment/post. It also has a full time staff managing the community. I don't see either of those things changing on HN =/

Re: Meltdown, aka “Dear Intel, you suck”

#128

Post by hah-muh-rabbi » Sat, Jan 06, 2018, 5:05 PM UTC

Tomte wrote: post #47

mrweasel wrote: post #43

Earlier quoted context omitted.

The OpenBSD developers are mad that Intel didn't inform them, or any of the other BSDs. Only Microsoft and Linux developers where included in the information that was under embargo. I don't think they're upset that Intel made a mistake, not more so that most others anyway.

Don‘t they refuse to honor embargoes? That would be an explanation why they got no information privately.

They do, they break embargoes and that's why they are now paying the price for it.

Re: Meltdown, aka “Dear Intel, you suck”

#129

Post by shagie » Sat, Jan 06, 2018, 5:07 PM UTC

mannykannot wrote: post #71

discoursism wrote: post #51

Earlier quoted context omitted.

Here's an LWN article that references Theo's position on embargoes: https://lwn.net/Articles/601958/

This article seems to suggest that of all the BSDs, only OpenBSD / Theo takes this position - at least in in the case of the OpenSSL problems, the others got advance notice and participated in the embargo. It might be argued that the risk of the exploit making it into the wild would have been higher if the BSDs were notified, on account of the sort of accidental premature disclosure that actually happened. This would…

To me, one of the interesting bits there is the accidental timing of a comment.

From https://www.krackattacks.com

> We notified OpenBSD of the vulnerability on 15 July 2017, before CERT/CC was involved in the coordination. Quite quickly, Theo de Raadt replied and critiqued the tentative disclosure deadline: “In the open source world, if a person writes a diff and has to sit on it for a month, that is very discouraging”. Note that I wrote and included a suggested diff for OpenBSD already, and that at the time the tentative disclosure deadline was around the end of August. As a compromise, I allowed them to silently patch the vulnerability. In hindsight this was a bad decision, since others might rediscover the vulnerability by inspecting their silent patch. To avoid this problem in the future, OpenBSD will now receive vulnerability notifications closer to the end of an embargo.

Note the date there that de Raadt was commenting on the discouragement of sitting on a fix for a month. What is the likelihood that he would be very discouraged to sit on it for six months? What if it was a three month embargo that changed to a six month embargo - when would the fix be released?

I would assume that those are questions that need to be asked prior to notifying a project.

Re: Meltdown, aka “Dear Intel, you suck”

#130

Post by sverige » Sat, Jan 06, 2018, 5:09 PM UTC

jmull wrote: post #100

Is it the right time to call out the fundamental wrongness of Intel(/Apple/Microsoft/etc) outrage narratives? I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems. um. This is as radical as taking a stand that the sun sets in the west. I like HN because of the promise that people think just…

> I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems.

> um. This is as radical as taking a stand that the sun sets in the west.

If all you're picking up from this is the emotional component (aka "outrage"), I think you've missed the point. The larger problem now is that Intel (in this case) consciously chose to ignore serious risks for their customers and is currently doing their best PR job to downplay the impact of those risks now that they have been exposed.

The reality is that these bugs are potentially catastrophic. But maybe we are supposed to simply accept that that is part of the risk of living in this modern world.

When large corporations make serious mistakes that are predictable and that others publicly warned about, they deserve all the criticism that comes their way.

My question is why anyone who doesn't work for the PR department of one of these corporations feels the emotional need to defend them from justly deserved criticism? They didn't include all the responsible stakeholders in their mitigation efforts, that decision put the users of those OSes at risk, and so the developers of those OSes are pissed about it.

Why is that unacceptable to you? Why do you consider that to be "wrong"?