5 ms·

So Intel tried to shut *BSD out of the process again (like they did for the original Spectre/Meltdown) so they didn't feel they had to respect any embargo?

superflyguy 8y ago
Eh? An embargo is where you share information with someone on the grounds they don't release it until a certain date. If you come by the information some other way then clearly you're not a party to the embargo.
- Dylan16807 8y ago
  You can respect an embargo even if you got your information elsewhere.
  - tedunangst 8y ago
    The existence of the embargo is usually a secret as well. Hard to play the game when you're not told the rules.
  - throwaway2048 8y ago
    why would you? The language being used makes it sound like somehow openbsd is breaking agreements. Considering this appears to be the result of the false perception that OpenBSD breaks embargos they are a party too, its important to fight this loose usage of words.
    - tjoff 8y ago
      In the vast majority of cases it is the prudent way to go about it and not doing it (with intent) is often reckless and a dick move well deserved of criticism. This/these cases however might be an exception. I fully agree that one should be careful of propagating such false perceptions about OpenBSD (or any other entity).
      - superflyguy 8y ago
        I disagree. As long as the embargo is purely related to this or that company profiting over another, as opposed to being potentially a matter of safety (see the UK D Notice system, for example), it's laughable to describe breaking something covered by someone else's optional embargo as a "dick move". On the contrary, it's generally highly amusing, and at the very least informative.
        tjoff 8y ago
        I agree and that is exactly what I meant. However these circumstances can also be a matter of safety. For instance, an easily exploitable SSH vulnerability can incur serious damage to lots of institutions. Further, the embargo isn't/shouldn't be about protecting Intel - it's about protecting everyone that uses Intel CPUs (sometimes those goals are aligned, sometimes not). How you go about that is one thing and if you intentionally disrespect that embargo (whether you were in on it or not) means that the assumptions and motivations for the embargo are invalidated and the consequences could be huge. Now you don't necessarily have to agree with the embargo but if you don't know the consequences (in this case it looks like it was likely to be known) you take it up on yourself that you (with most likely very limited information) can identify the consequences of doing such a disclosure. It's the same problem of doing a irresponsible disclosure of a major vulnerability. Most do consider that to be a dick move.
blattimwind 8y ago
Assuming this were true, then they wouldn't have known about the embargo, since we are assuming they were not part of the process.
- ori_b 8y ago
  Rumors circulate, people talk, leaks happen.
- CodeWriter23 8y ago
  Posted on HN 3 days ago, Theo de Raadt speculates about the FP big and discusses being frozen out by Intel. Video. Contains profanity. https://news.ycombinator.com/item?id=17275844 https://news.ycombinator.com/item?id=17275844
  - qubex 8y ago
    Don’t know why you’re being voted down. Thread and video are pertinent, language is not the commenter’s fault. Here’s my token upvote.
  - delbel 8y ago
    the most important information shared in this post, downvoted.
  - kchoudhu 8y ago
    It's worth noting that TdR is not the bringer of profanity in the video. I wasn't impressed by whoever dropped the f-bomb.
    - beefhash 8y ago
      Seems to be Warner Losh[1], previously one of the FreeBSD core team members[2]. [1] https://marc.info/?l=openbsd-misc&m=152883510311011&w=2 https://marc.info/?l=openbsd-misc&m=152883510311011&w=2 [2] https://wiki.freebsd.org/WarnerLosh https://wiki.freebsd.org/WarnerLosh
      - 8y ago
deleted 8y ago
[deleted]
cat199 8y ago
What 'embargo'? An embargo is state imposed. Not corporation imposed.
- hyper2grams 8y ago
  You're being pedantic.
- teraflop 8y ago
  The usage of "embargo" to mean a generic, non-governmental impediment or prohibition is at least 200 years old. https://www.merriam-webster.com/dictionary/embargo https://www.merriam-webster.com/dictionary/embargo
  - cat199 8y ago
    but if you don't agree to it, it has no force, and therefore is no embargo..
tomxor 8y ago
> So Intel tried to shut *BSD out of the process again (like they did for the original Spectre/Meltdown) so they didn't feel they had to respect any embargo? Yes and no... It's really important that this be viewed from the context of the discussion opened by theo in the video from the previous HN post (provided in this thread by codewriter23). Here's My TL;DW from the irritatingly poor quality video: Yes, they are pissed that they are being excluded (rumour is amazon and google have been implementing fixes). However, they are not necessarily "not-respecting" the embargo according to the proposed methodology Theo outlines in the video: to (speculatively) exclude _any_ potential source of speculative execution vulnerabilities to ensure they are safe without giving weight to any one rumour. And then gradually prune back the precautions as they become publicly disclosed. Apparently they used a similar strategy previously to provide patches for sshd before they were allowed to publicly disclose the vulnerability... prevent the bug from being reachable without revealing exactly what is broken in the commits by never touching the offending code. In this case the idea is to be non-specific, disable a whole class of things even though it might not be necessary (because in this case they really don't know where the problem is exactly). Disclaimer: The above is not my opinion, it was my interpretation of the relevant context from the video, i do not know if it matches their actions. It seems possible the commenter on the oss-security mailing list is not aware of this strategy and is giving more weight to openBSD's patch than it deserves (and perhaps wrongly implying openBSD have disrespected the embargo as a sideffect). However these patches are way beyond me so I cannot tell.
- teamhappy 8y ago
  The braking the embargo part is about the FPU issue that they published a patch for a few days before Theo gave the talk. The part you're referencing is Theo speculating about the next bug. He suspects fixing it requires flushing a cash line but he doesn't know which one (because he doesn't know where the bug is) so he proposes flushing all of them until the bug is published and then removing the flushes that aren't necessary. He then mentions the last serious OpenSSH bug. Instead of publishing a fix for the bug (and thus disclosing the bug) they decided to publish a patch that moved a bunch of code around and just happened to also make the buggy code unreachable. Then they told everybody to upgrade and once that happened they could safely disclose the bug and publish a fix for it. No embargo necessary and everybody got the fix at the same time. (I assume that's why he brought it up.)

superflyguy 8y ago

Eh? An embargo is where you share information with someone on the grounds they don't release it until a certain date. If you come by the information some other way then clearly you're not a party to the embargo.

Dylan16807 8y ago
You can respect an embargo even if you got your information elsewhere.
- tedunangst 8y ago
  The existence of the embargo is usually a secret as well. Hard to play the game when you're not told the rules.
- throwaway2048 8y ago
  why would you? The language being used makes it sound like somehow openbsd is breaking agreements. Considering this appears to be the result of the false perception that OpenBSD breaks embargos they are a party too, its important to fight this loose usage of words.
  - tjoff 8y ago
    In the vast majority of cases it is the prudent way to go about it and not doing it (with intent) is often reckless and a dick move well deserved of criticism. This/these cases however might be an exception. I fully agree that one should be careful of propagating such false perceptions about OpenBSD (or any other entity).
    - superflyguy 8y ago
      I disagree. As long as the embargo is purely related to this or that company profiting over another, as opposed to being potentially a matter of safety (see the UK D Notice system, for example), it's laughable to describe breaking something covered by someone else's optional embargo as a "dick move". On the contrary, it's generally highly amusing, and at the very least informative.
      - tjoff 8y ago
        I agree and that is exactly what I meant. However these circumstances can also be a matter of safety. For instance, an easily exploitable SSH vulnerability can incur serious damage to lots of institutions. Further, the embargo isn't/shouldn't be about protecting Intel - it's about protecting everyone that uses Intel CPUs (sometimes those goals are aligned, sometimes not). How you go about that is one thing and if you intentionally disrespect that embargo (whether you were in on it or not) means that the assumptions and motivations for the embargo are invalidated and the consequences could be huge. Now you don't necessarily have to agree with the embargo but if you don't know the consequences (in this case it looks like it was likely to be known) you take it up on yourself that you (with most likely very limited information) can identify the consequences of doing such a disclosure. It's the same problem of doing a irresponsible disclosure of a major vulnerability. Most do consider that to be a dick move.

blattimwind 8y ago

Assuming this were true, then they wouldn't have known about the embargo, since we are assuming they were not part of the process.

ori_b 8y ago
Rumors circulate, people talk, leaks happen.
CodeWriter23 8y ago
Posted on HN 3 days ago, Theo de Raadt speculates about the FP big and discusses being frozen out by Intel. Video. Contains profanity. https://news.ycombinator.com/item?id=17275844 https://news.ycombinator.com/item?id=17275844
- qubex 8y ago
  Don’t know why you’re being voted down. Thread and video are pertinent, language is not the commenter’s fault. Here’s my token upvote.
- delbel 8y ago
  the most important information shared in this post, downvoted.
- kchoudhu 8y ago
  It's worth noting that TdR is not the bringer of profanity in the video. I wasn't impressed by whoever dropped the f-bomb.
  - beefhash 8y ago
    Seems to be Warner Losh[1], previously one of the FreeBSD core team members[2]. [1] https://marc.info/?l=openbsd-misc&m=152883510311011&w=2 https://marc.info/?l=openbsd-misc&m=152883510311011&w=2 [2] https://wiki.freebsd.org/WarnerLosh https://wiki.freebsd.org/WarnerLosh
    - 8y ago

deleted 8y ago

[deleted]

cat199 8y ago

What 'embargo'? An embargo is state imposed. Not corporation imposed.

hyper2grams 8y ago
You're being pedantic.
teraflop 8y ago
The usage of "embargo" to mean a generic, non-governmental impediment or prohibition is at least 200 years old. https://www.merriam-webster.com/dictionary/embargo https://www.merriam-webster.com/dictionary/embargo
- cat199 8y ago
  but if you don't agree to it, it has no force, and therefore is no embargo..

tomxor 8y ago

> So Intel tried to shut *BSD out of the process again (like they did for the original Spectre/Meltdown) so they didn't feel they had to respect any embargo? Yes and no... It's really important that this be viewed from the context of the discussion opened by theo in the video from the previous HN post (provided in this thread by codewriter23). Here's My TL;DW from the irritatingly poor quality video: Yes, they are pissed that they are being excluded (rumour is amazon and google have been implementing fixes). However, they are not necessarily "not-respecting" the embargo according to the proposed methodology Theo outlines in the video: to (speculatively) exclude _any_ potential source of speculative execution vulnerabilities to ensure they are safe without giving weight to any one rumour. And then gradually prune back the precautions as they become publicly disclosed. Apparently they used a similar strategy previously to provide patches for sshd before they were allowed to publicly disclose the vulnerability... prevent the bug from being reachable without revealing exactly what is broken in the commits by never touching the offending code. In this case the idea is to be non-specific, disable a whole class of things even though it might not be necessary (because in this case they really don't know where the problem is exactly). Disclaimer: The above is not my opinion, it was my interpretation of the relevant context from the video, i do not know if it matches their actions. It seems possible the commenter on the oss-security mailing list is not aware of this strategy and is giving more weight to openBSD's patch than it deserves (and perhaps wrongly implying openBSD have disrespected the embargo as a sideffect). However these patches are way beyond me so I cannot tell.

teamhappy 8y ago
The braking the embargo part is about the FPU issue that they published a patch for a few days before Theo gave the talk. The part you're referencing is Theo speculating about the next bug. He suspects fixing it requires flushing a cash line but he doesn't know which one (because he doesn't know where the bug is) so he proposes flushing all of them until the bug is published and then removing the flushes that aren't necessary. He then mentions the last serious OpenSSH bug. Instead of publishing a fix for the bug (and thus disclosing the bug) they decided to publish a patch that moved a bunch of code around and just happened to also make the buggy code unreachable. Then they told everybody to upgrade and once that happened they could safely disclose the bug and publish a fix for it. No embargo necessary and everybody got the fix at the same time. (I assume that's why he brought it up.)