3 ms·
An eye for an eye works only until everyone is blind. You seem to have several deeply misguided premises. 1. We don't know ARM knowingly shipped these chips a
by ILikeConemowk 9y ago
An eye for an eye works only until everyone is blind.
You seem to have several deeply misguided premises.
1. We don't know ARM knowingly shipped these chips although they were vulnerable. Bugs happen.
2. Even if this was the case, an individual can show, and ought to, show decency and empathy towards others.
3. This last comment of yours is a straw man and I doubt you are incapable of seeing this. You parent's argument was much more nuanced and elaborate than your rebuttal.
- tptacek 9y agoI don't think you understand the dynamics here. I don't think anyone knowingly shipped vulnerabilities. That's an impossibly low bar: all you have to do to "not know" is to not spend any money on security verification. The complaint here is that AMD was outdone on verification by 4 dudes in a basement.
- empath75 9y agoI think saying that they were outdone by 4 dudes in a basement is being intellectually dishonest. There are a lot of dudes in a lot of basements looking for vulnerabilities all the time. Those four happened to find it, but there were hundreds of others looking. There’s no amount of money that amd can spend that would make them not outgunned eventually by all the hackers and intelligence services and security researches looking to break it.
- tptacek 9y agoWhy do you assume that there were hundreds of other people looking for these vulnerabilities? Chances are, when we learn the technical details, we're going to find out that they're bog-standard memory corruption flaws in driver code, and that the thing that prevented anyone from discovering them was that nobody looked for them.
- flounders 9y agoHave you ever worked with a code base before? Even when you scrutinize for bugs, they still can go unspotted. Sometimes hundreds of people can look at the same code and not see anything wrong with it. Software has the benefit of having higher levels of abstraction, I haven't designed any hardware but as far as I'm aware it's not easy to abstract it. That will make it much harder to find things. While 4 guys in a basement may have found this vulnerability, it doesn't mean they will find every vulnerability or that anyone else would have this as they had. Throwing money at verification will not make it fool proof.
- empath75 9y agoYou honesty think nobody was looking for security vulnerabilities?
- tptacek 9y agoIn drivers for an AMD security feature almost nobody uses? Yes.