5 ms·

People here seems to be mentioning short sellers being connected to this research as if there's some sinister collusion going on. This is the entire point of s

by volgo 9y ago

People here seems to be mentioning short sellers being connected to this research as if there's some sinister collusion going on. This is the entire point of short selling, and SEC encourages this type of activism. It allows people who can provide expert knowledge to profit off a trade if it can reveal damaging and legitimate information about a company For example, a short seller last year revealed (through extensive research), that Valeant Pharmaceuticals was stuffing its channels and faking its finances. He placed a huge sort sell and went public with the damaging info - tanking the stock from $270 to $12 and made a ton of profit off of it: https://www.nytimes.com/2017/06/08/magazine/the-bounty-hunter-of-wall-street.html https://www.nytimes.com/2017/06/08/magazine/the-bounty-hunte... Without this incentive, why would anyone bother to reveal damaging info? You're placing your self as a target with no reward. The payment is the natural balance of the market. So yes, this research firm is connected w a hedge fund, and they have a very vested interest. But that doesn't make their claim untrue

rebuilder 9y ago
Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though.
- zrm 9y ago
  > Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though. A good way for companies to prevent this is to have a generous bug bounty program. Money is still transferred from the shareholders to the researchers, but then the company can impose conditions like delaying public disclosure for a reasonable time to prepare a fix.
  - deong 9y ago
    If it's actually someone attempting to make money on a short or to benefit from a working relationship with a competitor, then a bug bounty program does nothing. No one can run a bounty program that pays out anywhere near as much as the information is actually worth to an adversary. Bug bounties work to engender a bit of good will among researchers and to provide some incentive to an otherwise neutral party to play ball. They don't mean shit to a hedge fund or a competitor in a multi-billion dollar industry.
    - ISL 9y ago
      Not unless the bounties are large enough to attract the attention of a hedge fund.
      - zrm 9y ago
        > Not unless the bounties are large enough to attract the attention of a hedge fund. Which they should be if the alternative is a much larger loss to the company's share value. The shareholders come out ahead to pay five million on a bug bounty if the alternative is to lose a billion dollars in market cap.
  - throwawayjava 9y ago
    I'm not a finance expert, but my very lay person understanding of how financial markets work tells me that those would have to be some rather huge bounties. See e.g., the effect on Intel from earlier this year: https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hitting-the-companys-stock-big-time-while-rival-amd-is-soaring/ https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hittin...
- hdyr 9y ago
  This is the crux of it. The short disclosure window could hurt 3rd parties unnecessarily. Although I enjoy reading grandparent's counterpoint
  - dcow 9y ago
    More and more lately I'm leaning towards the, "responsible disclosure is a bunch of crap" camp. You have to be "in" to get the news. Even if you're "in" security people love to play info war power games and withhold things because it tickles their jimmies, etc. And don't forget, you're deliberately keeping a vulnerability secret from consumers during a long period where you have no idea who else knows about it. If I'm a "user" or 3rd party and there's a critical vuln in some system I depend on, I want to know that I shouldn't use it or that I should take extra caution or whatever rather than being clueless in all in the name of the vendor's image.
    - tptacek 9y ago
      This is how the whole industry ran in the mid-1990s. There were secret vendor lists that the cool kids got to be on. If you didn't have the right friends, you were shut out. Vendors took their sweet time getting patches out, because their preferred customers were all read in and had workarounds in place. It was a shitty way to organize an industry, and it fell apart with Bugtraq and full-disclosure security. It's sad to see people arguing for a return to those norms, especially since the rejection of them correlates with a renaissance in our understanding how to secure software.
      - cortesoft 9y ago
        I agree, but I am curious if you have any suggestions on how we should be handling disclosure?
        dsacco 9y ago
        Don't sue people if they publish vulnerabilities without any notification to the vendor, as long as they never overstepped and exploited it themselves.
- dahdum 9y ago
  It's also a huge incentive to overstate the severity. Their goal is to profit off the panic they can produce, so every statement they make is likely heavily biased in that direction. That said, I don't mind that these "research" organizations exist. Only bothers me when they put the general public at risk (or attempt to) for their own gain.
  - addicted 9y ago
    There is far far more incentive for AMD and its partners to understate the severity.
    - dahdum 9y ago
      On an individual level, it's much less I'd think. Inciting a panic could be life changing amounts of money for the researchers, paid out by the hedge fund returns. AMD isn't going to crash and burn over these flaws anymore than Intel (at 5 year high) did.
    - Retric 9y ago
      I disagree. AMD needs to maintain it's reputation over time. Short sellers make their profit over a few hours/days and don't care if they are proven wrong. So, AMD has vastly more incentive to be accurate than short sellers.
      - bigiain 9y ago
        Pity that vast incentive didn't seem to work out when they promoted all these chips as having "Firmware Trusted Platform Module", "Secure Encrypted Virtualization", "AMD Secure Processor", and "AMD Secure OS" as features. AMDs incentive, like any corporation, is to maximise shareholder value. Same as any tiny little security research firm. If a research firm can maximise their profit buy discovering vulnerabilities and shorting stock before disclosing them, is that any ethically worse than a chip company rushing out flawed hardware with big flashy marketing bullet points claiming how secure they are? (I'm not saying short-selling chip vendor stocks on the back of vulnerabilities is a way I'd choose to make a living, but surveillance capitalism doesn't seem an "ethically better" industry to work in either...)
- volgo 9y ago
  It's not their problem. There's no obligation for them to give any warning at all. They can just go public, short the stock, and watch it fall. The warning is just a polite thing to do
  - bigiain 9y ago
    Not even "polite" really, it's benefitting the vendors bottom line at the expense of the researchers. Do you think there's _any_ chance AMD would have offered these guys money in the sort of magnitude they stand to gain short selling AMD? I'm pretty sure if they'd asked AMD would have responded with a blackmail lawsuit instantly.
benchaney 9y ago
That's fine, but it doesn't change the fact that the possibility (likelyhood?) of financial gain affects the authors credibility. Especially since it is already strained by other issues with this disclosure.
coryfklein 9y ago
It seems to me that disclosing vulnerabilities is in a different category from disclosing fraud. In the latter case, the only entities that suffer materially is the fraudulent organization and its investors, in the former you have the additional potential to expose all users of the vulnerable software to risk.

by volgo 9y ago

rebuilder 9y ago

Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though.

zrm 9y ago
> Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though. A good way for companies to prevent this is to have a generous bug bounty program. Money is still transferred from the shareholders to the researchers, but then the company can impose conditions like delaying public disclosure for a reasonable time to prepare a fix.
- deong 9y ago
  If it's actually someone attempting to make money on a short or to benefit from a working relationship with a competitor, then a bug bounty program does nothing. No one can run a bounty program that pays out anywhere near as much as the information is actually worth to an adversary. Bug bounties work to engender a bit of good will among researchers and to provide some incentive to an otherwise neutral party to play ball. They don't mean shit to a hedge fund or a competitor in a multi-billion dollar industry.
  - ISL 9y ago
    Not unless the bounties are large enough to attract the attention of a hedge fund.
    - zrm 9y ago
      > Not unless the bounties are large enough to attract the attention of a hedge fund. Which they should be if the alternative is a much larger loss to the company's share value. The shareholders come out ahead to pay five million on a bug bounty if the alternative is to lose a billion dollars in market cap.
- throwawayjava 9y ago
  I'm not a finance expert, but my very lay person understanding of how financial markets work tells me that those would have to be some rather huge bounties. See e.g., the effect on Intel from earlier this year: https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hitting-the-companys-stock-big-time-while-rival-amd-is-soaring/ https://qz.com/1171391/the-intel-intc-meltdown-bug-is-hittin...
hdyr 9y ago
This is the crux of it. The short disclosure window could hurt 3rd parties unnecessarily. Although I enjoy reading grandparent's counterpoint
- dcow 9y ago
  More and more lately I'm leaning towards the, "responsible disclosure is a bunch of crap" camp. You have to be "in" to get the news. Even if you're "in" security people love to play info war power games and withhold things because it tickles their jimmies, etc. And don't forget, you're deliberately keeping a vulnerability secret from consumers during a long period where you have no idea who else knows about it. If I'm a "user" or 3rd party and there's a critical vuln in some system I depend on, I want to know that I shouldn't use it or that I should take extra caution or whatever rather than being clueless in all in the name of the vendor's image.
  - tptacek 9y ago
    This is how the whole industry ran in the mid-1990s. There were secret vendor lists that the cool kids got to be on. If you didn't have the right friends, you were shut out. Vendors took their sweet time getting patches out, because their preferred customers were all read in and had workarounds in place. It was a shitty way to organize an industry, and it fell apart with Bugtraq and full-disclosure security. It's sad to see people arguing for a return to those norms, especially since the rejection of them correlates with a renaissance in our understanding how to secure software.
    - cortesoft 9y ago
      I agree, but I am curious if you have any suggestions on how we should be handling disclosure?
      - dsacco 9y ago
        Don't sue people if they publish vulnerabilities without any notification to the vendor, as long as they never overstepped and exploited it themselves.
dahdum 9y ago
It's also a huge incentive to overstate the severity. Their goal is to profit off the panic they can produce, so every statement they make is likely heavily biased in that direction. That said, I don't mind that these "research" organizations exist. Only bothers me when they put the general public at risk (or attempt to) for their own gain.
- addicted 9y ago
  There is far far more incentive for AMD and its partners to understate the severity.
  - dahdum 9y ago
    On an individual level, it's much less I'd think. Inciting a panic could be life changing amounts of money for the researchers, paid out by the hedge fund returns. AMD isn't going to crash and burn over these flaws anymore than Intel (at 5 year high) did.
  - Retric 9y ago
    I disagree. AMD needs to maintain it's reputation over time. Short sellers make their profit over a few hours/days and don't care if they are proven wrong. So, AMD has vastly more incentive to be accurate than short sellers.
    - bigiain 9y ago
      Pity that vast incentive didn't seem to work out when they promoted all these chips as having "Firmware Trusted Platform Module", "Secure Encrypted Virtualization", "AMD Secure Processor", and "AMD Secure OS" as features. AMDs incentive, like any corporation, is to maximise shareholder value. Same as any tiny little security research firm. If a research firm can maximise their profit buy discovering vulnerabilities and shorting stock before disclosing them, is that any ethically worse than a chip company rushing out flawed hardware with big flashy marketing bullet points claiming how secure they are? (I'm not saying short-selling chip vendor stocks on the back of vulnerabilities is a way I'd choose to make a living, but surveillance capitalism doesn't seem an "ethically better" industry to work in either...)
volgo 9y ago
It's not their problem. There's no obligation for them to give any warning at all. They can just go public, short the stock, and watch it fall. The warning is just a polite thing to do
- bigiain 9y ago
  Not even "polite" really, it's benefitting the vendors bottom line at the expense of the researchers. Do you think there's _any_ chance AMD would have offered these guys money in the sort of magnitude they stand to gain short selling AMD? I'm pretty sure if they'd asked AMD would have responded with a blackmail lawsuit instantly.

benchaney 9y ago

That's fine, but it doesn't change the fact that the possibility (likelyhood?) of financial gain affects the authors credibility. Especially since it is already strained by other issues with this disclosure.

coryfklein 9y ago

It seems to me that disclosing vulnerabilities is in a different category from disclosing fraud. In the latter case, the only entities that suffer materially is the fraudulent organization and its investors, in the former you have the additional potential to expose all users of the vulnerable software to risk.