5 ms·
Anyone know whether there will be any repercussions for continuing to keep the flawed chips on the market, and for that matter continuing to sell these as of to
by j1vms 9y ago
Anyone know whether there will be any repercussions for continuing to keep the flawed chips on the market, and for that matter continuing to sell these as of today.
I'm not talking about recalls of purchased product, just that Intel chose to continue to keep chips with major known issues on store shelves instead of choosing some other option.
- wmf 9y agoIntel did release a microcode update (which "couldn't" be released early due to "responsible disclosure"). Taking all their processors off the shelves would be suicide.
- cabaalis 9y agoCan someone explain the disclosure procedures that were actually followed? It seems like everybody freaked out at the same time. AWS had apparently already protected all but a "small percentage" of their VMs. If there was some kind of responsible disclosure taking place, allowing vendors time to upgrade, it seems like it wouldn't have had so much impact.
- mousa 9y agoI think the disclosure procedures were abandoned because people outside of the loop had figured it out from Linux kernel upgrades.
- eridius 9y agoAIUI disclosure wasn't supposed to happen until tomorrow. Google broke the embargo because, as you said, people were starting to figure it out.
- bonzini 9y agoBreaking the embargo at 5pm EST was also coordinated with everyone who had been disclosed early. It wasn't anarchy.
- aidenn0 9y agoAlso by AMD's e-mail that all-but-disclosed the mechanism of Meltdown.
- Waterluvian 9y agoHow does a microcode update work? My sparse understanding is that instructions are physically encoded in the chips. That you could take a microscope and look at the different instructions.
- TomV1971 9y agoThat was a very long time ago. Microcode can be loaded by the BIOS.
- Operyl 9y agoCan also be loaded at boot time by the kernel, etc.
- cjbprime 9y agoOr even after boot time, I think -- you shut down one CPU at a time to load it.
- xxs 9y agoMost of the microcode nowadays is loaded by the OS (not BIOS)
- chopin 9y agoToday I learned something. Doesn't that open a huge attack surface? This code would run super-privileged isn't it?
- 0x0 9y agoCPUs will only accept uploads of microcode if they can verify the digital signature, of which the private keys are only known to the CPU manufacturer (i.e. Intel or AMD). Probably it will also only allow upgrades, not downgrades, on a running system. So the only "attack" you can perform if you've gained root is to patch CPU security vulnerabilities by upgrading to a newer valid microcode, and then also only until the next reboot.
- skummetmaelk 9y agoThe problem is that there really is no other viable option for most use cases yet.
- joshtopher 9y agoSo far they're not admitting that there's anything wrong with their chips. If they're flawed enough to pull them from the shelves they're flawed enough to warrant a recall and they really don't want to do a recall
- conanbatt 9y agoOne thing that is bafflingly absurd of the american legal system is that any admission of guilt makes you liable for any consequence. So stonewalling is the only choice. Intel can be trapped as a company to find half-way solutions, because proposing any of them can force them to do full-way solutions. Result, this vulnerability will last forever.
- ams6110 9y agoINTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY OF ANY KIND INCLUDING WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT OF INTELLECTUAL PROPERTY, OR FITNESS FOR ANY PARTICULAR PURPOSE. IN NO EVENT SHALL INTEL OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING FROM THE PURCHASE OR USE OF THE PRODUCT, EVEN IF INTEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. BECAUSE SOME JURISDICTIONS PROHIBIT THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO CERTAIN CUSTOMERS https://click.intel.com/terms-of-use https://click.intel.com/terms-of-use
- conanbatt 9y agoAS SOON AS YOU ACCEPT THE TERMS OF USE OF HACKER NEWS YOU RELINQUISH ALL YOUR ASSETS, INCLUDING PRESENT AND FUTURE GAINS OF ALL POTENTIAL INCOME IN ANY COUNTRY UNDER ANY CIRCUMSTANCE
- grzm 9y agoI understand that it's all-caps in the original, but if you would decapitalize it, our collective eyes would appreciate it :) Here's an online form (I'm sure there are others) that'll do that for you: https://convertcase.net https://convertcase.net
- deleted 9y ago[deleted]