3 ms·

One might ask why it is that Project Zero's 90 day disclosure rule was waived for Intel in this case and the were apparently given an indefinite amount of time

One might ask why it is that Project Zero's 90 day disclosure rule was waived for Intel in this case and the were apparently given an indefinite amount of time to do nothing about it. Why is it that if the disclosure (after it was found by someone else) was scheduled for early January that everyone was still not ready and the patches still aren't released and they are still buggy and broken? It is clear from the fact that Google broke their own disclosure rules that they were colluding with Intel to a certain extent to manage the fallout from this.

tristanj 9y ago
Why do you assume Google waived their disclosure policies for Intel? I thought it was clear Google waived their disclosure policy for themselves. Google had an enormous self-interest to avoid disclosure. At the 90 day disclosure date, their Google Cloud product was vulnerable to all three exploit variants. From their blog post, it looks like at that point they didn't have acceptable mitigations for variant 2. It took Google until December, or nearly 3 months after the projected disclosure date, to fully patch their Cloud product. Google only announced the exploits to the public after they had mitigations in the pipeline for all their products. Reviewing the timeline, isn't it more convincing that Google tried to protect themselves first, rather than Intel? Furthermore, if Google really cared so much about 'colluding with Intel' and having disclosures 'waived for Intel', why did they announce these exploits before Intel could release a microcode patch for their CPUs? It does not add up.
- saas_co_de 9y ago
  > Reviewing the timeline, isn't it more convincing that Google tried to protect themselves first, rather than Intel? It is true that both would suffer from disclosure. > why did they announce these exploits Because they got outed and so they had to develop a cover story. > It does not add up. Many parts of the story do not add up, probably because the parties involved are lying.
  - tristanj 9y ago
    > Because they got outed and so they had to develop a cover story. Your claim is at odds with Google's explanation of why they announced the exploits prior to the coordinated disclosure date. In their press article, they state: We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation. The full Project Zero report is forthcoming (update: this has been published; see above). Recall Google's announcement came the day after multiple reports speculating the existence of a CPU hardware bug. See https://news.ycombinator.com/item?id=16046636 https://news.ycombinator.com/item?id=16046636 and https://news.ycombinator.com/item?id=16052451 https://news.ycombinator.com/item?id=16052451 . Google's statement on why they announced before the coordinated disclosure date is valid. There was an unprecedented amount of embargo violations prior to the coordinated disclosure date. There were multiple high-profile reports correctly speculating the nature of the vulnerabilities. Where is your evidence this is a 'cover story'? I can't see it. > probably because the parties involved are lying. It is trivial to accuse someone of lying. Specifically, what did Google lie about, and where did they lie about it? Most importantly, where is your evidence that Google is lying?

tristanj 9y ago

Why do you assume Google waived their disclosure policies for Intel? I thought it was clear Google waived their disclosure policy for themselves. Google had an enormous self-interest to avoid disclosure. At the 90 day disclosure date, their Google Cloud product was vulnerable to all three exploit variants. From their blog post, it looks like at that point they didn't have acceptable mitigations for variant 2. It took Google until December, or nearly 3 months after the projected disclosure date, to fully patch their Cloud product. Google only announced the exploits to the public after they had mitigations in the pipeline for all their products. Reviewing the timeline, isn't it more convincing that Google tried to protect themselves first, rather than Intel? Furthermore, if Google really cared so much about 'colluding with Intel' and having disclosures 'waived for Intel', why did they announce these exploits before Intel could release a microcode patch for their CPUs? It does not add up.

saas_co_de 9y ago
> Reviewing the timeline, isn't it more convincing that Google tried to protect themselves first, rather than Intel? It is true that both would suffer from disclosure. > why did they announce these exploits Because they got outed and so they had to develop a cover story. > It does not add up. Many parts of the story do not add up, probably because the parties involved are lying.
- tristanj 9y ago
  > Because they got outed and so they had to develop a cover story. Your claim is at odds with Google's explanation of why they announced the exploits prior to the coordinated disclosure date. In their press article, they state: We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation. The full Project Zero report is forthcoming (update: this has been published; see above). Recall Google's announcement came the day after multiple reports speculating the existence of a CPU hardware bug. See https://news.ycombinator.com/item?id=16046636 https://news.ycombinator.com/item?id=16046636 and https://news.ycombinator.com/item?id=16052451 https://news.ycombinator.com/item?id=16052451 . Google's statement on why they announced before the coordinated disclosure date is valid. There was an unprecedented amount of embargo violations prior to the coordinated disclosure date. There were multiple high-profile reports correctly speculating the nature of the vulnerabilities. Where is your evidence this is a 'cover story'? I can't see it. > probably because the parties involved are lying. It is trivial to accuse someone of lying. Specifically, what did Google lie about, and where did they lie about it? Most importantly, where is your evidence that Google is lying?