Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

anandtech.com

Post reply on HN
Print view View original

41–50 of 359 posts

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#41

Post by throwaway__22 »

wtallis wrote: post #15
sneak wrote: post #5

> AMD is in the process of responding to the claims, but was only given 24 hours of notice rather than the typical 90 days for standard vulnerability disclosure. No official reason was given for the shortened time. 90 days is not a standard. Nothing was shortened. People are allowed to publish their research whenever they like. Vendor advance notification is optional. Full, immediate disclosure is responsible.

> Full, immediate disclosure is responsible. Hiring a PR firm before disclosing to the vendor is not responsible. Briefing select press before disclosing to the vendor is not responsible.

Or selectively telling your buddies in teh know and helping them to fix their shit, while keeping uncool kids out of the loop. Now that's irresponsible.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#42

Post by zitterbewegung »

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

AMD's stock was negative multiple times today ($11.38 on March 13, 2018 10AM,and at 12Noon on NASDAQ). Shorting the stock would be an obvious play. I have heard of people thinking about trading on security flaws in products but never seen it done in real life.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#43

Post by swyx »

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

i always find the importance of these disclaimers blown way out of proportion to their probable economic impact. AMD shares are -up- 2% right now, for a presumably negative piece of news. the stock market is a big and sometimes inscrutable place. but ethics likes to treat things as morally black and white.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#44

Post by gshulegaard »

tptacek wrote: post #21
robert_foss wrote: post #9

24hrs notice is unheard of. Who works for CTS-Labs? Attaching your name to a company like that should disqualify you from any future jobs in the security space.

Who do you think you speak for? Assuming the vulnerabilities aren't fabricated --- it's happened before with other companies --- attaching your name to that white paper probably guarantees you lifetime employment in security research. "Unheard of"? People have dropped serious vulnerabilities with _zero_ warning before.

Perhaps this is my ignorance, but I was under the impression that security disclosures are usually tightly coordinated to minimize exposure of innocent users.

> "Unheard of"? People have dropped serious vulnerabilities with _zero_ warning before.

Could you point me to an example of a zero warning disclosure that exposed a large amount of users without first attempting to coordinate with the responsible party?

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#46

Post by samfriedman »

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

Is this kind of language common in other security disclosures?

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#47

Post by swyx »

zitterbewegung wrote: post #42
vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

AMD's stock was negative multiple times today ($11.38 on March 13, 2018 10AM,and at 12Noon on NASDAQ). Shorting the stock would be an obvious play. I have heard of people thinking about trading on security flaws in products but never seen it done in real life.

yes and its $11.77 now (up 2%)

this is not in the same league but i recall AMD/INTC also traded up on the spectre/meltdown debate. a lot of insecure chips ironically leads to a lot of demand for new secure-er chips.

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#48

Post by strictnein »

notacoward wrote: post #45

24 hours means they don't deserve to be called security researchers. They're exploit creators. Given the material effect this would have on AMD's stock, one might also reasonably speculate about their financial interests.

This. Especially with the disclaimer that others have noted:

> "we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

Re: Security Researchers Publish Ryzen Flaws, Gave AMD 24 Hours Prior Notice

#50

Post by stevievee »

vesrah wrote: post #28

https://amdflaws.com/disclaimer.html "you are advised that we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"

This is too well organized and presented. My guess is that this has to be financed in some part by a group of short-sellers.

They made a rookie mistake though - AMD is plagued by day-traders and algorithms who couldn't give a damn about the fundamentals.

Boy the future of capital markets is looking grim.

Post reply on HN