1–10 of 131 posts
Related: The RCE that AMD won't fix - https://news.ycombinator.com/item?id=46906947 - Feb 2026 (173 comments)
The RCE that AMD wouldn't fix
mrbruh.com
Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.
AMD didn't deny it was a vulnerability; they denied it was in the scope of the bounty program. Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.
AMD didn't deny it was a vulnerability; they denied it was in the scope of the bounty program. Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.
What hair is this splitting? The issue was that AMD allowed a known and serious security vulnerability to exist within their customers’ systems, for months, and acted with a lack of candor while doing so.
Those that have access to international network links.
Those that have the ability to generate new firmware that simply passes the CRC32 checksum.
The discussion the video references [1] [1] - https://news.ycombinator.com/item?id=46906947
UPDATE! Within a day of this blowing up on Hacker News, AMD reached back
out to me and said they would be looking into the matter after all.
Earlier quoted context omitted.
What hair is this splitting? The issue was that AMD allowed a known and serious security vulnerability to exist within their customers’ systems, for months, and acted with a lack of candor while doing so.
It's not hair-splitting; it's central to the idea of a bug bounty. Too many people have weird ideas about what bug bounties are for.
AMD didn't deny it was a vulnerability; they denied it was in the scope of the bounty program. Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.
Earlier quoted context omitted.
It's not hair-splitting; it's central to the idea of a bug bounty. Too many people have weird ideas about what bug bounties are for.
Yeah, like the weird idea that those programs are intended to in some way reduce the number of exploitable bugs actually out there.