29 ms·

Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed

• bluecalm 8y ago
  Here is one thing we can do about it: make public service announcement to our users that we no longer recommend Intel CPUs because of security holes, censorship and crippled performance. I am going to do that today. While we only have several thousand users they do CPU intensive work, buy a lot of new CPUs and rent a lot of servers. My small contribution will likely amount to low-mid 6 figures out of Intel pocket in coming 2-3 years. Please consider such announcement if you could do some damage as well.
  • dvfjsdhgfv 8y ago
    That's one of the best ways to actually make a change.
  • eps 8y ago
    This amounts to little more than making a statement at the expense of your users. It would've carried that much more weight if it were _your_ low-mid 6 figures that were redirected away from Intel.
    • harry8 8y ago
      It's Intel's policy and silliness that is at the expense of this person's users. Making those users aware of it is absolutely defensible on the grounds of it being the right thing to do. Intel are relying on customers ignorance, in fact they're trying to contractually ensure it! The Streisand effect is exactly what they deserve.
    • Jonnax 8y ago
      Intel isn't really that much far ahead to say that users are going to be negatively affected.
      • bluecalm 8y ago
        Intel is actually behind in performance/price ration by a wide margin at least on workloads which can make use of many cores. The margin is likely getting bigger after the latest patches.
    • nalllar 8y ago
      It will likely benefit their users. AMD's EPYC processors are cheaper for the same performance as intel's, as well as allowing more memory per processor. As they allow more cores per socket this can also often massively reduce per-socket licensing cost, if you have the misfortune of using software which requires that.
    • gnulinux 8y ago
      Well, AMD currently has better CPUs for high-performance computing, so OP's users would benefit from this public service announcement, if anything.
      • Symmetry 8y ago
        I thought it was the opposite of that? That is, AMD chips are currently great for most workloads but Intel still has a definite edge in working with big vectors of floating point numbers of the sort you usually encounter in HPC. Mostly because their core's vector units are 512 instead of 256 bits wide.
        • celrod 8y ago
          Skylake-X and certain Xeons have avx-512 (which includes two 512 bit fma units). The rest only have 256 bit wide vectors, like Ryzen. But they still have the advantage of two 256 bit fma units, while Ryzen instead relies on two 128 bit fma units, meaning the fma instructions critical to matrix operations are faster on Intel. I think the idea for HPC though is that you want to offload these highly vectorizable operations to a GPU. Or maybe you're doing a lot of Monte Carlo that it is hard to vectorize. I really do like avx-512 though. If you're writing a lot of your own code, and that code involves many small-scale operations and has control flow (like in many Monte Carlo simulations), it's a lot easier than mucking with a GPU. If you're using gcc though, be sure to add `-mprefer-vector-width=512`, otherwise it will default to 256 bit vectors (clang and Julia use 512 by default).
  • tomp 8y ago
    Honest question: is AMD any better? Do they somehow manage to avoid Spectre / Meltdown without a slowdown?
    • simion314 8y ago
      AMD is better, they are still affected by side channel attacks but they did not skipped on security checks and are not affected by speculative execution AFAIK https://www.amd.com/en/corporate/security-updates https://www.amd.com/en/corporate/security-updates
      • coherentpony 8y ago
        > ...and are not affected by speculative execution AMD's chips definitely speculatively execute instructions. It's a common performance trick. AMD's chips also definitely throw an exception at retirement (of course) for instructions that attempt to load a privileged address, just like Intel's chips do. The difference is that when AMD's chips see a load instruction, the load isn't executed until it knows that the address isn't privileged. Intel's chips do execute the load (but then throw away the result when it realises the address was privileged). The speculative part is for instructions that depend on the result of the load.
        • simion314 8y ago
          >The difference is that when AMD's chips see a load instruction, the load isn't executed until it knows that the address isn't privileged. Intel's chips do execute the load (but then throw away the result when it realises the address was privileged) Thank you for the detailed explanation, can't we conclude that AMD engineering is more defensive then Intel, this is what I concluded.
          • coherentpony 8y ago
            Based on this datapoint? I don't think so. They're vulnerable to other side-channel attacks. Both AMD and Intel hire really smart people, but this stuff is really, really hard.
  • dhimes 8y ago
    I am in the market for a new rig- looks like I'll be going with AMD.
    • holtalanm 8y ago
      same. i _was_ looking at getting an HP Spectre x360 with the i7 8550U. Now, I'm going to look explicitly at laptops with Ryzen chips. I think the Spectre might have a Ryzen model, but don't know.
      • dragontamer 8y ago
        AMD is severely behind on the Laptop space. In the Desktop space, I can definitely recommend AMD. But Laptops are totally Intel right now. There are AMD Laptops, but they are hard to recommend. Most are low-end offerings at best (laptop manufacturers don't put the high-end stuff with AMD). As long as high-end HP / Dell / Lenovo / Asus / Acer / Apple / Microsoft Surface are all Intel-based, you're basically forced to use an Intel Laptop. Desktops... you can build your own. And even if you couldn't, there are a ton of custom computer builders out there making great AMD Desktop rigs. ------------- With that being said, AMD laptops are competitive in the $500 to $750 space. Low-end to mid-tier laptops... the ones with poor mouse controls, driver issues, bad keyboards, low-end screens and such. But hey, they're cheap. Its not really AMD's fault. But in any case, its hard for me to find a good AMD laptop. So... that's just how it is.
        • holtalanm 8y ago
          the new HP Envy x360 13z doesn't look bad. Kind of waiting to see what the Lenovo ThinkPad A285 looks like, as well.
          • dragontamer 8y ago
            The HP Envy x360 has a noticeably worse screen though. Its definitely not the same class or caliber as the Spectre x360. That's what I'm talking about: most laptop manufacturers offer a "premium" Intel laptop. But then they have a lower-quality AMD one on the side. Nothing AMD has done wrong per se, just laptop manufacturers refuse to sell AMD on the high-end.
• johnklos 8y ago
  I'm really curious how Intel could even imagine this is enforceable. For instance, if I have a server with shell access for many users, am I supposed to forbid my users from publishing benchmarks? If they do, am I liable since I "agreed" to the license? Or are they, even though they never "agreed" to the license? It just doesn't make sense.
  • muppetman 8y ago
    Surely it's just designed to scare the big media websites from publishing numbers.
    • 0x8BADF00D 8y ago
      This is censorship, plain and simple. They cannot command everyone to abridge their speech, even if their license terms say so. It is unenforceable and illegal.
      • lathiat 8y ago
        It's also crazy to my mind. The reality is these various issues are all having potentially significant impacts on performance -- and it's not just the microcode related changes, but also the kernel changes, etc. It is kind of ridiculous to require everyone to do their own testing and not allow basic numbers to be published. I also find it fascinating in that in theory your BIOS update can include these changes.. does this anti benchmark license apply if you reflash a new BIOS or just buy a new motherboard with the new bios and then use the same type of CPU to compare? Makes me want to look at some BIOS and motherboard EULAs now...
        • SmellyGeekBoy 8y ago
          This is a very good point. What about replacing a motherboard (but not CPU) due to motherboard failure or just to get some extra feature or other? If the new BIOS includes the microcode updates are you legally forbidden from benchmarking your old CPU?
        • 8y ago
• bochoh 8y ago
  It would seem that paired with https://news.ycombinator.com/item?id=17820248 https://news.ycombinator.com/item?id=17820248 that Intel is reeling back like a wounded animal. I'm intrigued as to what comes next - real innovation or dirty tactics to stay on top?
  • sorokod 8y ago
    Why not both?!
    • jagger27 8y ago
      Worked wonders for Nvidia.
• Nition 8y ago
  They better be wary of the Streisand Effect here. Banning benchmarking just makes it seem like the performance hit is going to be serious, which makes everyone even more curious.
  • duxup 8y ago
    I didn't know anything about this... now I'm really curious what the benchmarks are. Now that it is news they're pretty much begging for someone to do the benchmarks. This reminds me of the oracle license that was so broad it prevented users from talking to other users about their experience with the product... any experience.
    • cm2187 8y ago
      And I don't think Intel has any way to prevent some blog in China or Russia to run some standardised benchmark tools on their box. Intel will not even achieve preventing these benchmarks popping up, it will just draw attention to them.
    • pbhjpbhj 8y ago
      Perhaps they're not complete imbeciles and this is a marketing stunt, turns out the benchmarks are fantastic??
      • duxup 8y ago
        I would very much enjoy that.
  • dwild 8y ago
    Could be a "reverse" Streisand Effect. Any slowdown would have been pretty public, the microcode update is still a big deal and the expectation weren't clear, I'm pretty sure the results were worst than the average expectation. Now though, the expectation are much higher, people expect it to be pretty high and maybe the results are now actually lower than theses expectations. So yeah maybe more publicity but maybe now people will say "not as bad as I thought", instead of saying "much worse than I thought".
• eksemplar 8y ago
  Aside from my vic20 and c64 I’ve only ever owned intel CPUs, and those two may have been intel as well, I wouldn’t know. I’ve never made a decision to chose Intel based on benchmark, I’ve bought them because they’ve always been great for me. So it’ll be ironic when I buy an AMD processor when I upgrade for cyberpunk 2077, because of benchmarks. Not because AMD is faster, they may be but I wouldn’t know, no, it’ll be because intel are douches. I didn’t like how they handled their vulnerabilities, or how they still released chips with the errors long after it was discovered because they had production planned, and now they are pulling stuff like this? Heh.
  • 0xcde4c3db 8y ago
    > Aside from my vic20 and c64 I’ve only ever owned intel CPUs, and those two may have been intel as well, I wouldn’t know. At that time, few home computers were based on Intel processors because they were too expensive. Commodore's early computers, like Atari's, were based on the MOS Technology 6502 (made by ex-Motorola engineers as a cheaper and easier-to-integrate alternative to the Motorola 6800; the corresponding Intel-killer was the Zilog Z80 notably used in various CP/M and MSX computers). Commodore eventually acquired the company, rebranding it Commodore Semiconductor Group. A CMOS version of the 6502 is still sold by the Western Design Center [1]. [1] http://www.westerndesigncenter.com/wdc/w65c02s-chip.cfm http://www.westerndesigncenter.com/wdc/w65c02s-chip.cfm
    • exikyut 8y ago
      One click-chain of curiosity later, and I learned that they sell a little educational SBC based on the 6502. http://wdc65xx.com/boards/w65c02sxb-engineering-development-system/ http://wdc65xx.com/boards/w65c02sxb-engineering-development-... Pro: it looks like an AT motherboard from 1985 Con: it's $189 :s
      • peteri 8y ago
        They do have some cheaper ones ($29 & $99) problem is I can't quite figure out why I need one. https://www.tindie.com/stores/dcwdc/ https://www.tindie.com/stores/dcwdc/
• eight_ender 8y ago
  Has Intel just outlawed any review website (gaming, enthusiast, etc) from ever posting benchmarks of their CPUs again? I feel like they didn't think this through.
  • paulie_a 8y ago
    And even if they did think it through. It should be aggressively ignored.
    • tzmudzin 8y ago
      ... or just the reverse: clearly omitted in all benchmarks, stating you buy at your own risk because of Intel's unwillingness to subject its products to examination. [Sure it's not going to fly given Intel's market position, but it's a tempting thought anyway...]
      • _ph_ 8y ago
        Right, technically speaking, a review site now only has the choice of either ignoring Intels terms or no longer consider Intel processors in their benchmarking at all. As a reviewer , I would not benchmark unpatched products on a general basis.
  • wtallis 8y ago
    If we tech journalists were actually seriously concerned that Intel would be dumb enough to try to enforce those provisions against us, then we'd just ask the motherboard vendors for updated pre-release firmware that incorporates the new microcode but doesn't come with Intel's license agreement attached. We often go that route anyways because it's easier to update the motherboard than to ensure that every OS you're testing against (especially Windows) has loaded the newer microcode.
    • lagadu 8y ago
      Also if you get the update via windows update you get the patch without having ever agreed to the no-benchmarking clause, so you're free to publish anyway.
• amluto 8y ago
  I can think of two theories: 1. It's a mistake. Someone in legal got carried away. 2. The performance of the L1TF mitigation is so awful that someone at Intel thought it would be a good idea to try to keep the performance secret. (Which leads to option 2b. The performance of the L1TF mitigation is so awful that somemone at Intel is afraid that Intel could be sued as a result, and they want to mitigate that risk.) I would guess it's #1.
  • phyller 8y ago
    Normally I'd give people the benefit of the doubt, but in this case I think Intel has already shown that they have no credibility in anything anymore. They only ever spin everything, the last time anyone said something truthful (former CEO mentioned they needed to try to limit AMD to 20% server share, up from less than 1%), he was not only fired but publicly humiliated.
  • kbumsik 8y ago
    I think it's #1 but this legal change has been more than 2 weeks and there's no response from Intel in this problem. I don't understand why Intel is screwing everything lately.
  • djsumdog 8y ago
    The wording sounds like it bans any and all benchmarks. How would groups like Linus or Dave2D even operate? It honestly doesn't seem remotely enforceable.
  • TheRealPomax 8y ago
    It works for Oracle (it is famously illegal to publish benchmarks of DB2 vs other engines), I'm sure intel can make it work for them thanks to Oracle's court case(s).
    • jclulow 8y ago
      I'm pretty sure DB2 is an IBM thing.
      • 8y ago
• beefhash 8y ago
  As a side note: Some of the license changes also block Debian from updating their intel-microcode package[1]. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158#14 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158#14
  • deleted 8y ago
    [deleted]
  • ddtaylor 8y ago
    This seems like it would be a big deal considering this whole thing is related to servers and I have to imagine some server operators are running Debian? Maybe at the bare metal level their all running RHEL, which I presume doesn't care about the license restrictions.
    • cyphar 8y ago
      From the article linked in TFA[1], Debian appears to be the only distribution that is refusing to release it. Gentoo has made it so that you have to agree to the new license when upgrading your intel-ucode package, while other distribution vendors (Arch, Red Hat, and SUSE) all appear to be shipping it without issue. The argument from Intel is that the new changes don't actually affect distributions, as distributions are given the right to redistribute the microcode in the license (and this is separate to allowing third parties to publish benchmarks). Either that, or the lawyers at Red Hat and SUSE missed this somehow (though this is unlikely -- at SUSE all package updates go through a semi-automated legal review internally, similar to how openSUSE review works). I do understand Debian's ethical issue with this though, and I applaud them for standing up for their users (though unfortunately it does leave their users vulnerable -- I imagine it was a difficult decision to make.) [I work at SUSE, though I don't have any hands-on knowledge about how this update was being handled internally. I mostly work on container runtimes.] [1]: https://www.theregister.co.uk/2018/08/21/intel_cpu_patch_licence/ https://www.theregister.co.uk/2018/08/21/intel_cpu_patch_lic...
      • shakna 8y ago
• deleted 8y ago
  [deleted]
• molyss 8y ago
  This is beyond idiotic. Any company that's about to release this in their production server will want to benchmark the effect of the fix. And some of them will have to provide the results to their customers.
• ulfw 8y ago
  Oh intel. What has happened to you? Do they really think this could even remotely be enforceable?
  • Jach 8y ago
    Oracle and MS SQL Server have had no benchmark disclosures in their licenses for a long time, so Intel probably thinks so.
    • throwaway77384 8y ago
      So this is illegal? http://phpdao.com/mysql_postgres_oracle_mssql/ http://phpdao.com/mysql_postgres_oracle_mssql/
      • yrro 8y ago
        I don't think it's illegal for the author to violate the terms of the license that they agreed to in order to be able to run Oracle RDBMS legally.
        • throwaway77384 8y ago
          Feels like it makes very little sense to even attempt to suppress benchmarking. Like, comparing products is at the heart of capitalist / free market trade / society, surely?
    • deleted 8y ago
      [deleted]
• robocat 8y ago
  > (iii) use or make the Software available for the use or benefit of third parties i.e. you cannot allow anyone else to use your CPU? I get that the intent is probably about distribution, but the software runs on the CPU so is being used by whoever is using the CPU.
• FiloSottile 8y ago
  Forget benchmarks, how is (iii) (“You will not [...] use or make the Software available for the use or benefit of third parties”) compatible with shared hosting and rented virtual machines, where the provider has to apply the microcode for the benefit of the guests?
  • gnud 8y ago
    Forget shared hosts, how about when I write something for my client on my employers machine? I'm using the software for the benefit of a third party...
    • lucb1e 8y ago
      I read that license line as that you can't make it available for the benefit of others, not that you can't use it for the benefit of others. But of course that's the logical interpretation and the only one that matters is the worst possible interpretation. I'm not a native English speaker nor lawyer, would be interesting to see another opinion on this.
• gesman 8y ago
  This TOS is driven by lawyers, not by business decision makers
  • tzmudzin 8y ago
    Are lawyers running their business, or are business decision makers making business decisions?
    • Valmar 8y ago
      Lawyers, I might guess, if this TOS is anything to go by.
    • theyinwhy 8y ago
      So business decision makers made the decision to let their lawyers be business decision makers?
      • tzmudzin 8y ago
        It certainly looks like that. Not sure it was the wisest move though...
• mnm1 8y ago
  Bring on the lawsuits. Ignore the patches and sue Intel for the underlying security flaws. When they point to the patches, clearly state that because of the new license, they do not solve the problem and will not be applied. No one signed up for this when they bought an Intel CPU and that's saying a lot considering all the bullshit we do sign up for when buying one. This is outrageous. Intel should be sued in a class action. Whether they could have known about the exploits or not is irrelevant at this point. They refuse to provide proper patches without this license which is equivalent to providing no patches at all while knowing about the exploit. They have provided faulty hardware without a way to fix it. A lawsuit or a few thousand is the only way to get resolution on this.
  • aerotwelve 8y ago
    How many mandatory binding arbitration clauses and/or class action waivers have Intel hidden in their license agreements over the years? If they did it right, they never have to worry about a class action lawsuit (and the horrible press that comes with it) anytime soon. Which, of course, makes the kind of systematic deception Intel is trying to pull off here much easier. It's a feature!
    • flukus 8y ago
      I could be wrong but I think binding arbitration is almost exclusively an American thing. The rest of the world can sue.
    • mnm1 8y ago
      I wasn't aware that CPUs have licenses. It's certainly not something I've ever agreed to on purpose or otherwise. There is no box or manual to imply that I have ever agreed to such a license. I'm not doubting you, I'm just wondering where this license lies and when/how did I agree to it?
  • drewmol 8y ago
    I agree but is it possible this is aimed at avoiding class action suits about false advertised performamce, by attempting to make the new benchmarks inadmissible?
• farhanhubble 8y ago
  Is it even legal to do so? Tomorrow Intel can ask us not to benchmark the clock speed.
• squarefoot 8y ago
  Sorry if I stress this even one more time, but we badly need 100% open iron, I mean something beefier than SiFive. If there is any effort in this direction, then, say for a year, most donations should be diverted over there. Closed hardware is becoming the unavoidable medium used to push closed firmware into everyone's system, that's a lot more important than benchmarks.
  • copperx 8y ago
    I doubt RISC V is going to solve the problem you're complaining about, even if it becomes "beefier." RISC V is going to be a launchpad for proprietary custom accelerators, which is great, but will still involve pushing closed firmware.
  • radialbrain 8y ago
    Have you seen https://www.raptorcs.com/TALOSII/ https://www.raptorcs.com/TALOSII/? Typing this on my own right now.
    • iforgotpassword 8y ago
      Fails the 'reasonable pricing' check. Who's gonna pay 6x of what you pay for a comparable intel system? This is only for the super-enthusiast.
      • glenneroo 8y ago
        Technology often starts out expensive and enthusiast only, but if Intel keeps throwing these wild punches in every direction, why wouldn't we see a steady migration to alternatives? AMD is definitely benefiting from Intel's recent decisions, I am sure Raptor is also starting to get more business. A few more years of shady Intel decisions combined with sufficient negative press and I am sure the market will gladly decide. There are surely plenty of large corporations who can afford the costs and would prefer being able to audit everything themselves. This seems like the perfect storm for competition to finally have a chance.
• deleted 8y ago
  [deleted]
• infinity0 8y ago
  > Another issue is whether the customer should install the fix at all. Many computer users don’t allow outside or unprivileged users to run on their CPUs the way a cloud or hosting company does. For them, these side-channel and timing attacks are mostly irrelevant, and the slowdown incurred by installing the fix is unnecessary. lol, javascript
  • xref 8y ago
    but the sandboxes, think of the inescapable sandboxes!
  • kbenson 8y ago
    "Many customers" meaning people and orgs running server software on direct hardware. Does your caching or database server run user provided code? Is it accessible to the outside in any way? If not, then maybe it doesn't need the patch.
    • deleted 8y ago
      [deleted]
    • infinity0 8y ago
      The article says "Many computer users" not "Many customers". Furthermore when the article mentions "customers" elsewhere we can probably assume it means "Intel customers" which is a much greater subset than the group you're talking about, and which would be probably less than 1% as numerous as the "Many computer users" that run javascript. lol, javascript
      • kbenson 8y ago
        > which would be probably less than 1% as numerous as the "Many computer users" that run javascript. So? Many does not mean most. There's a choice to be made, apply the security patch and accept the performance loss, or don't. Some people may not need to to remain close to as safe as they were previously based on their configuration for some of their systems, and I would guess the number of systems easily numbers in the millions. This is a benefit for those people, and worth mentioning, even if it's not nearly a large a number as the total number of CPUs or customers.
• headmelted 8y ago
  Before Zen, we all kind of assumed they were so far ahead that AMD were more likely to be out of business before they would ever be a credible threat again. I actually thought Intel must have had some tricks up their sleeves in terms of performance gains that we hadn't seen yet, simply because there was no market need to roll them out and they had so many years of coasting on marginal gains. Seeing them taking this stance looks a lot like the microcode hit is that bad, and that the emperor has no clothes. Clearly, they don't have an answer to AMD at all. If this is true, their shareholders should be asking serious questions about why they've nothing significant to show for all that time and money spent when they were raking it in without a serious competitor.
  • carlmr 8y ago
    >they've nothing significant to show for all that time and money spent when they were raking it in without a serious competitor. Big companies rarely innovate without competition around.
    • yohann305 8y ago
      This is certainly a myth. Everyone knows, including big companies, that as you grow in size you have a harder time innovating. The classic "lean startup" book mentions this issue and gives the example of Intuit's in-house accelerator/incubator. No way Intel doesn't know about it too. https://www.forbes.com/sites/forbestechcouncil/2018/04/19/innovation-isnt-just-for-startups-how-big-companies-can-tap-their-creative-power/#535dd848686b https://www.forbes.com/sites/forbestechcouncil/2018/04/19/in...
      • deleted 8y ago
        [deleted]
      • gowld 8y ago
        What myth? As you say, bigger companies have a harder time innovting.
        • 8y ago
• elihu 8y ago
  > The security fixes are known to significantly slow down Intel processors, which won’t just disappoint customers and reduce the public regard of Intel, it will probably lead to lawsuits (if it hasn’t already). Suddenly having processors that are perhaps 5% to 10% slower, if they are to be secure, is a significant damage to many companies that run server farms or provide cloud services. Maybe I'm missing something here, but I was under the impression that the Spectre/Meltdown mitigations have a big performance penalty, but the more recent L1TF mitigations should have little or no impact, and that the new license only showed up recently on the new L1TF mitigation patches. Is the L1TF mitigation actually a lot worse than I thought, or does this license apply to the earlier Spectre/Meltdown patches, or is Bruce Perens just being sloppy and conflating the two? Either way, I agree with him that draconian license terms shouldn't be attached to bug fixes.
  • cyphar 8y ago
    > Is the L1TF mitigation actually a lot worse than I thought, or does this license apply to the earlier Spectre/Meltdown patches, or is Bruce Perens just being sloppy and conflating the two? He isn't being sloppy. According to the Debian package maintainer[1], the new license only applies to the new patches (ones after 2018-08-07) which were released long after the Spectre/Meltdown ones -- because the license was only changed in the 20180807 microcode update (and because Debian didn't block the previous Spectre/Meltdown releases over license concerns). In theory, nobody can actually tell you how bad the L1TF mitigation is because of the new license terms (a comparison before-and-after L1TF mitigation would be providing you with comparison test results). [1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158#14 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158#14
• waldbeere 8y ago
  Simple solution in comments: [ i7-8750H ] User1: do benchmark on no patch Os post in thread User2: do benchmark on patched OS, post in thread Is not a compare only performance graph between two users computer remember USER1 is patched
  • dvhh 8y ago
    you would have to demonstrate that the config from user1 is identical to the configuration of user2, wich mean you would have to split the patch up to the microde update.
• mehrdadn 8y ago
  Even if everyone plays by the rules, can't someone in another jurisdiction publish comparison results? How do they expect this to work?
  • ksrm 8y ago
    I'm curious to know how valid this is in EU countries. Anyone know?
    • rbehrends 8y ago
      Against consumers, almost certainly unenforcable under the Unfair Terms in Consumer Contracts Directive alone, nevermind that some countries have even stricter laws regarding unfair contract terms. [1] https://en.wikipedia.org/wiki/Unfair_Terms_in_Consumer_Contracts_Directive_1993 https://en.wikipedia.org/wiki/Unfair_Terms_in_Consumer_Contr...
• dayaz36 8y ago
  I'm done with Intel
• gammatrigono 8y ago
  Time to disable automatic Windows Updates.
  • wtallis 8y ago
    Windows automatic updates are one of the easier ways to get the new microcode without agreeing to the new license terms. But there are plenty of other reasons to disable Windows Update (not that Windows will respect your decision).
    • jwilk 8y ago
      How do you keep the system secure without Windows Update enabled?
      • wtallis 8y ago
        All of the Windows machines that I use for work are firewalled and have no internet access, primarily so that they won't interrupt my work with fucking updates, but security is a nice side effect. My personal Windows machine has updates enabled because I don't mind if it reboots when my back is turned, and my Linux and OS X machines can be trusted to ask before rebooting to apply updates. Microsoft has provided no real alternatives for those of us who need to be able to keep a Windows machine running overnight.
• ddtaylor 8y ago
  2018 has been an abysmal year for Intel so far. Multiple serious vulnerabilities that effect multiple areas of their products, Spectre, Meltdown, Management Engine, etc. The only thing they can control is how they respond and they've done a terrible job of that too. At this rate I'm expecting a consumer product agency to eventually get involved.
  • ikeyany 8y ago
    They also got rid of their CEO this year.
• flcknzwrg 8y ago
  This borders on unbelievable... I checked at intel directly just to make sure this is true: https://downloadcenter.intel.com/download/28039/Linux-Processor-Microcode-Data-File?v=t https://downloadcenter.intel.com/download/28039/Linux-Proces... The file https://downloadmirror.intel.com/28039/eng/microcode-20180807.tgz https://downloadmirror.intel.com/28039/eng/microcode-2018080... contains the license file with that laughable clause included. Now hand me the popcorn...
• harry8 8y ago
  I would like to see the New York Times co publish benchmarks with phoronix (or whomever has the relevant expertise and credibility) with a box detailing the ridiculous license and an editorial suggesting Intel investors may have cause for concern about managerial competence.
  • pbhjpbhj 8y ago
    Someone with a publishing arm at their disposal is surely shorting Intel as we speak, ready to publish just such a story?
• jve 8y ago
  > Since some similar exploits have been discovered for AMD and ARM CPUs, the answer is probably “no”. But certainly customers are upset. Whats to be upset? Don't update if you are upset. Choose between perf/security. What are the options, anyway? You can be upset that the things are the way they are, however you can't blame Intel/AMD/ARM, etc. You should have been upset if these vulerabilities were known and not fixed thou.
  • cyphar 8y ago
    People are upset because Intel is not allowing people to run benchmarks on their CPUs (the language is so vague that you could argue that running non-CPU benchmarks, or benchmarks for other software unrelated to Intel would violate this license). So you can't really make a "choice between performance/security", because nobody is allowed to publish data that would let you make an informed choice.
    • jve 8y ago
      Quoted text talks about being upset because of perf, not because of Intel not allowing benchmarks. Not allowing benchmarks - yeah, agree to that, that is a reason to be dissapointed or upset. But people throw words around: lawsuits, upset, etc.
      • cyphar 8y ago
        All the recent microcode patches to fix CPU security flaws have caused performance degradation, so it's fair to mention that people have been upset about this in the past (anecdotally, I know first-hand that people have disabled the patches because it's started to break software that has significant timeouts -- and they were obviously not happy that this was necessary). It's also (somewhat) fair to assume that this patch would also affect performance until proven otherwise, and Intel changing their license to disallow sharing comparative performance tests doesn't give me much faith that I'm wrong in that assumption.
  • alkonaut 8y ago
    I expect them to fix the security issues, and I expect them to allow me to both know and publish the performance effect of the fix. If the security issues are not fixed, I'm upset. If they are fixed but I'm not allowed to talk about the effects, then I'm more upset.
• mpartel 8y ago
  Good thing we still have a somewhat anonymous internet. I'd be surprised if there wasn't a benchmark or two on the HN front page by tomorrow. Might even come from a media organization if their lawyers deem this sufficiently unlikely to be enforcable in their country.
• h4b4n3r0 8y ago
  It’s as though Intel is being sabotaged from inside. Delays with 10nm, suspicious exit of Krzanich, harebrained unenforceable licensing schemes. My next machine will use Threadripper and this kind of shit just seals the deal.
• fbn79 8y ago
  It's a clear invite to benchmark.
• a3_nm 8y ago
  Amusingly, I don't think the summary in the article or article title correctly summarizes the legalese. What is forbidden seems to be to "publish or provide" benchmark results. So let's I boot my machine with the new microcode, run a benchmark, then reboot it with the old microcode and upload the results to my website (hosted on a machine that doesn't run the new microcode). I don't see how this violates the terms of the license. In general, these terms doesn't seem to be very carefully phrased. Point (i), and independently point (iii), apparently prevent you from running the software altogether.
• akerro 8y ago
  Can I publish benchmarks of 7zip, The Witcher 3 and OpenGPG from yesterday and tomorrow (after Intel patch, which was patched coincidentally)?
  • shakna 8y ago
    > (v) publish or provide any Software benchmark or comparison test results. This seems to exclude any benchmark that may be affected by the Software's performance... Which means any CPU benchmark. There is some play in the wording... And I'm taking the least favourable interpretation. But yeah... Seems like Intel have said no benchmarking, full stop.
    • mcv 8y ago
      > Seems like Intel have said no benchmarking, full stop. That doesn't mean it's enforceable. Companies say silly things all the time.
      • shakna 8y ago
        Absolutely. If they tried to uphold that least-favourable interpretation, then I would be reaching for anti-competitive laws, and other consumer protections, and perhaps even contract law as they say downloading the software, so you can see the license, is binding. It seems difficult to have a legal argument that it should be binding at all.
  • aneutron 8y ago
    This is why it just sounded stupid to me when I read the headline. The CPU IS the computer, sure I won't run Cinebench, but I'll want to run my web browser, and there are things called browser benchmarks because I want to know if Chrome is better than Firefox, coincidentally running older versions of the software on older machines. Will they sue me ?
    • akerro 8y ago
      >Will they sue me ? Are you in US? If the answer is yes, I'm happy to publish the results for you on my blog where they won't reach me.
• gigatexal 8y ago
  Yeah...super fishy. If you don’t want to show off your product something is wrong. If they released Speculative execution newly (in some alternate universe) they’d be touting the huge performance benefits and showing off a ton.
• chrisper 8y ago
  Couple months ago I got an AMD Ryzen for my homeserver. I am pretty happy with it. Next time I'll probably get an AMD for the desktop as well. But I am talking about 6 years at least
• bubblethink 8y ago
  >Since the microcode is running for every instruction, this seems to be a use restriction on the entire processor Does Intel's legal team even have a basic understanding of how computers work ? In essence, the word 'benchmark' ceases to exist after this microcode update. No more research in any domain. Back to hunting and gathering.
• adiusmus 8y ago
  Intel are the experts in their own products. If they don’t have confidence in them, why should we?
• bigon 8y ago
  Isn't the the license used for OEM that prevents Debian to upload the update? https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158
• wolfgke 8y ago
  My thougt based on the HN headline "Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed" (after having read the article, of course): Doesn't this show that it is time for someone to set up some kind of "ScienceLeaks" website, where scientists can upload research (results, papers, ...) anonymously which they are are not allowed to do legally because of various such "research-restricting" laws. --- UPDATE: Before people ask the potential question how the researchers are supposed to get their proper credit - my consideration is the following: Each of the researchers signs the paper with their own "public" key of a public-private key pair. This signature is uploaded as part of the paper upload. The "public" key is nevertheless kept secret by the researchers. When the legal risk is over and the researchers want to disclose their contribution, they simply make their "public" key really public. This way, anyboy can change that the signature that was uploaded from beginning on, indeed belong to this public key and thus to the respective researcher.
  • justinclift 8y ago
    Sleazy marketers would be all over that. :/
    • executesorder66 8y ago
      If they show reproducible results, then I don't see a problem. If they don't, well then you know it is either dodgy or not rigorous enough to take seriously.
      • justinclift 8y ago
        They'd definitely show reproducible results. eg either get their mates to submit matching fakes ones, or just submit an extra set themselves after slight tweaking That being said, as soon as someone with a clue comes along + tries them out and finds it's bogus... that would lead into potentially weird territory too. eg the dodgy submitters likely attempting to discredit the er... whistleblower(?). Seems like a re-run of an old story. :/
  • StavrosK 8y ago
• andy_ppp 8y ago
  How is this enforceable in Law - I mean surely free speech laws apply here? You can't be compelled by contracts like this to not talk, it's absurd. It doesn't even seem like a particularly well written clause as it could be interpreted to mean benchmarking the microcode update process not the hardware.
• close04 8y ago
  I'm pretty sure they can expect future article titles to be Massive performance penalty with latest firmware patches ... Intel CPUs hit so hard by latest patches that Intel bans benchmarks. Doesn't even need to have a content.
• minusSeven 8y ago
  This is why need more regulations so companies can't pull this shit....
• JTbane 8y ago
  >No benchmarking allowed If this isn't a smoking gun about performance loss due to vulns, I don't know what is. Intel is in hot water.
• crb002 8y ago
  Benchmarking clause is unenforcible. It's like a clause by an auto manufacturer you can't track gas milage. What you are supposed to just ignore how much gas you put in the tank? No different when your servers slow down and runs up your electric bills.
• acd 8y ago
  "Freedom of speech is a principle that supports the freedom of an individual or a community to articulate their opinions and ideas without fear of retaliation, censorship, or sanction." https://en.wikipedia.org/wiki/Freedom_of_speech https://en.wikipedia.org/wiki/Freedom_of_speech
• GrayShade 8y ago
  Phoronix already tested this: https://www.phoronix.com/scan.php?page=article&item=l1tf-early-look&num=1 https://www.phoronix.com/scan.php?page=article&item=l1tf-ear... and https://www.phoronix.com/scan.php?page=article&item=l1tf-foreshadow-xeon&num=1 https://www.phoronix.com/scan.php?page=article&item=l1tf-for.... The performance loss isn't that bad in most cases.
  • sir-alien 8y ago
    You might be right in "most" cases but looking at the benchmarks, there is quite a few cases which are used a lot in everday computing where performance literally hits rock bottom. Video rendering went from 600 frames per second down to 200 frames per second. That is a 60% or more performance loss.
    • GrayShade 8y ago
      Look at the default mitigation; the full one disables HT. Unless you're a cloud provider, the default is probably enough.
  • polkadotted 8y ago
    These seems to be linux's own mitigations against L1TF. There's no mention about microcode being updated here, which I assume isn't the case. I assume the microcode update could be either equal o slightly worse in terms of performance, as the CPU might need to flush more frequently. Which is pretty sad, as the status of kernel+microcode updates is quite confusing already. Some mitigations can take advantage of new microcode updates, if the kernel is recent enough. How does the pure soft-workaround compare in terms of performance to the microcode-assisted one? Note that, combining all workarounds for meltdown+spectre-v1/v2+l1tf can have a significant performance hit for some workloads which are not purely cpu-bound. On top of that HT is now looking like a bad idea to start with. I'm pretty sure that for a server where there's a lot of I/O and virtualization going on, enabling all the patches and workarounds + disabling HT can take a massive cut in overall throughput.
    • GrayShade 8y ago
• zmix 8y ago
  It is sad to see Intel moving this way, but the Internet will find a way around this. As it did so often.
• aruggirello 8y ago
  So what will these guys do? https://www.cpubenchmark.net https://www.cpubenchmark.net
• punnerud 8y ago
  Under EU legislations these rules is void and null. In addition you can’t put rules to stop scraping of databases. The only rules that does apply is patents and copyright if you want to redistribute/sell. You are free to change, modify, reverse-engineer every product you can view or get access to.
• JudasGoat 8y ago
  The Tech Press seems to be only covering the patch, while ignoring the NDA.https://www.zdnet.com/article/windows-10-alert-all-versions-get-new-intel-patches-for-spectre-foreshadow-bugs/ https://www.zdnet.com/article/windows-10-alert-all-versions-... and https://hothardware.com/news/microsoft-windows-10-patches-spectre-foreshadow-side-channel-exploits https://hothardware.com/news/microsoft-windows-10-patches-sp...
• sir-alien 8y ago
  The no publishing terms is pretty much null and void outside the USA. Many non-US countries have unfair contract laws that make certain contracts (EULA) illegal and unenforceable. So if you and your site are outside the USA and your country has the appropriate consumer protection laws, benchmark and publish away. I would be certainly interested in the level of degraded performance.
• ajb 8y ago
  Intel release a faulty product, and to get the fix you are required to sign up to additional terms and conditions. Is that even legal? If it is, it shouldn't be.
• grecy 8y ago
  Does intel seriously think there won't be hundreds of people publishing benchmarks? We live in a time where thepiratebay still thrives, Snowden did his think and wikileaks is a thing, and Intel thinks they'll stop someone publishing benchmarks.... of a cpu.... ?
• xoa 8y ago
  I'm mildly surprised to do a quick search on this HN thread and not see the word "adhesion" appear. These microcode patches are for a significant design defect in a product that Intel already sold under both explicit and implicit promises and expectations of general functionality. The microcode patches aren't some luxury fully optional deal to make pretty patterns with case LEDs or something, they're a matter of critical safety and failing to install them might even expose downstream users to liability issues were the security problems to ever subsequently be exploited and then cause damage to a 3rd party (or even themselves, cybersecurity insurance is still a pretty new area but one of the few policies I've see had print I understood to be along the lines of "insured is expected to take reasonable precautions staying up to date with known patches"). Furthermore, Intel obviously presents no other options for users, using cryptographic signing to ensure that (even ignoring practical issues) there are zero other options to get microcode from. At least from my layman's perspective this certainly smells like an absolutely 100% textbook contract of adhesion. It's a "take it or leave it" offer, there is no room for bargaining, the term is far outside of reasonable expectations for the situation, it's simply an entirely one-sided item for the pure benefit of Intel leveraged coercively. In fact I think it may go far enough to hit the doctrine of unconscionability even. All this without even touching on any public interest issues. I think they should be challenged on this, that benchmarks should be published and Intel told to pound sand. Companies can stick whatever they want in a contract but that doesn't make it enforceable. And while admittedly often that can be quite gray territory and people toss out "not enforceable!!!" on the Internet far, far more often then is justified this particular instance really does look egregious. Yes, normally you can contract away your speech rights, but it's in the process of a real contract, with reasonably equal bargaining positions, proper consideration, etc. I think this goes too far. Perhaps Intel's real aim though is actually slimier, lots of major review sites depend pretty heavily on access that Intel (and other vendors) offer as well as free/cheap kit and the like which is optional and much easier to yank away at a whim. For those publications this may be a shot across the bow, of the sort "sure, you can challenge this if you want but it's a warning that if you do we can still punish you for it regardless of you winning the case."
  • Aloha 8y ago
    I'm not at yet convinced this was not simply user error in the legal department, or in the department that deployed the microcode to the website. The longer Intel is silent on the issue, the more likely this was their intent.
• emilfihlman 8y ago
  No benchmarking? Just benchmark and publish results anonymously. Intel can't take them down since the results are not illegal, only the "act" is prohibited by the EULA, which is not enforceable anyways. Intel should be seriously punished for trying to play like this.
• faragon 8y ago
  Intel already made an important effort regarding being Open Source friendly. In my opinion they should keep playing the nice guy role, avoiding PR fiascos.
• _ph_ 8y ago
  A total disaster. From all I know, any thorough fix of the exploits of speculative execution will slow down the processers significantly. Unless the terms are just a terribly blunder (which would be bad enough on its own), this points to a rather big marketing nightmare to show up. First of all the bad PR for those terms, and of course, sooner or later there will be thorough benchmarks on the net. I would even guess, one of the larger hardware review sites will openly ignore the terms and run them and wait for Intel to sue them. I could not imagine such a law suit achieving anything but directing even more attention to that publication and the obtained results.
• givinguflac 8y ago
  So, has anyone done any comparison or benchmarks?
• tait 8y ago
  Back in 2000 or maybe 2001, Intel had software one could use to create an image (something analogous to Paint or Photoshop). If I recall correctly, the novelty was that it was online. The license for that software was that Intel owned all rights to everything produced with it - your art was not your own. My Google-fu is weak today. Does anybody remember the name/have a reference?
• dhimes 8y ago
  What's the over/under for seeing published benchmarks? Monday, 2018-Aug-27 1200 UTC seem reasonable?
• mannykannot 8y ago
  These pernicious attempts to chip away at free speech through contractural riders is becoming more common and blatant. The best way to combat this sort of thing is for journalists, and anyone else discussing the issues of this vulnerability, to make a point of bringing it up, repeatedly. Whenever performance is an issue, point out that Intel is restricting the impact from being evaluated, which suggests that it is bad. Whenever security is an issue, point out that Intel is restricting the dissemination of the mitigation by imposing self-serving conditions on its use.
• Grollicus 8y ago
  > You will [..] not allow any third party to [..] publish or provide any Software benchmark or comparison test results I read this as everyone that distributes this has to change THEIR ToS to explicitly disallow THEIR users to provide benchmarks. Surprised any distro distributes this at all.
• rbc 8y ago
  I wonder what the folks over at top500.org will think of that?
• api 8y ago
  So... anyone want to link to some benchmarks hosted somewhere Intel can't mess with? I have Tor Browser.
• crististm 8y ago
  I'm sick of this kind of restrictions from anybody. They are obviously blind to the reputation damage they inflict on themselves. Regardless, what would be a compelling reason for which I should buy from Intel again? What kind of credibility do they build for themselves?
• fron 8y ago
  Intel's poor handling of the Meltdown fiasco and now this tomfoolery, means they have lost me as a customer forever. I'm on the AMD train now, never buying Intel again.
• sverige 8y ago
  > I'm not blaming Intel for this, I don't know if Intel could have foreseen the problem. The potential security issues with out of order processing were noted publicly at least as far back as 2007. The problem is that, on the whole, the entire industry doesn't really give a shit about security until it's too late, which is exactly the wrong time to start. I don't foresee this changing anytime soon. It will be interesting to see the downside of AI. Or maybe terrifying is a better word for it, since it could foreseeably include personal physical security. But before that time comes, people who think like me are still just pointy-headed paranoid security losers, I reckon.
  • api 8y ago
    Nobody is thinking about security and AI. I wonder how long it will be before someone images a neural net embedded into some product and then figures out how to trick it into behaving in some way that attacks some internal part of the program hosting it. I'm imagining things like images than when shown to image classifiers cause the classifier neural network to buffer overflow the conventional program hosting it and inject shellcode. Many types of neural networks are Turing-complete and are written in C by academics with no security experience. Fun times ahead.
• naasking 8y ago
  I wish lawmakers would tackle these kind of ridiculous provisions in EULAs. When you purchase something, you own it, and you should be able to do what you want with it. You shouldn't have to jump through absurd legal hurdles to use and talk about something you legally purchased. These aren't national security secrets for god's sake.
  • f055 8y ago
    They do. The same EULA will have different binding in the US and in Europe, for example. In many EU countries companies cannot draw arbitrary EULAs. If some sections infringe on consumer rights, then these sections simply don't apply and cannot be enforced. In essence, Intel can write whatever they wish in the EULA, but the consumer can do whatever they want as well. Depending on consumer's jurisdiction, it can create problems or not. US judiciary system is particularly unpleasant to the regular Joe, but the rest of the world is not. Go figure.
• S-E-P 8y ago
  Why not make it optional? I don't care about that level of security on most of my systems, I, and I hope the rest of you, have ways to mitigate most security issues like this anyhow. It's ridiculous.
• utopcell 8y ago
  Gag benchmarkers ? That is the Oracle way.
• cmurf 8y ago
  I'm willing to bet the license agreement in OEM firmware updates that also include the microcode patches, has this language.
• gaia 8y ago
  Let the benchmarks roll in... https://access.redhat.com/security/vulnerabilities/L1TF-perf https://access.redhat.com/security/vulnerabilities/L1TF-perf An estimation of man hours spent on this issue outside Intel https://www.servethehome.com/intel-publishes-l1tf-and-foreshadow-performance-impacts/ https://www.servethehome.com/intel-publishes-l1tf-and-foresh... Thought frequently mentioned, Phoronix did not run a benchmark comparing before and after application of the microcode update. Excerpt: To note, no microcode changes/updates were made to the systems under test for this article, just testing/comparing the kernel patches (https://www.phoronix.com/scan.php?page=article&item=l1tf-foreshadow-xeon&num=1 https://www.phoronix.com/scan.php?page=article&item=l1tf-for...)
  • panarky 8y ago
    > For companies like Google and Microsoft with the ability to get custom chips, and with custom schedulers that can ensure that VMs to not cross hyper-threading boundaries, this is something that can be relatively easily mitigated. For enterprise virtualization clouds, this may increase utilization of underutilized servers, and cause more server purchases in the future. Is this net-positive for VMware since customers will be required to buy more licenses for the same workload? Or is it net-negative because it makes public clouds more competitive?
• Buge 8y ago
  What if I install the microcode then sell the CPU, then the buyer does a benchmark? Am I banned from selling the CPU after installing the microcode?
• isthatart 8y ago
  Earth is flat and the theory of evolution is bogus. You will not allow and will not allow any third party to publish or provide any benchmark or comparison test results. Done with Science.
• mark-r 8y ago
  I hope the Streisand Effect[1] makes them regret this decision. [1] https://en.wikipedia.org/wiki/Streisand_effect https://en.wikipedia.org/wiki/Streisand_effect
• amelius 8y ago
  Would car manufacturers get away with this? "No emission tests allowed!"
• freeopinion 8y ago
  This raises the question about how you sort null with respect to processor performance. Given four benchmarks (7,null,8,6) where do you place the null?
• l3tf 8y ago
  Intel themselves have published before and after benchmarks, though. https://www.intel.com/content/www/us/en/architecture-and-technology/l1tf.html https://www.intel.com/content/www/us/en/architecture-and-tec...
• hansendc 8y ago
  Response from Intel that includes a new version of the license is here: https://twitter.com/imadsousou/status/1032680311753072640 https://twitter.com/imadsousou/status/1032680311753072640 Disclaimer: I work at Intel
• textmode 8y ago
  For discussion... Question: Are these license restrictions on right to disclose benchmarks enforceable? Question: If they are enforceable, do licensors ever try to enforce them? If not, why? A little background here: https://danluu.com/anon-benchmark/ https://danluu.com/anon-benchmark/ For example, this has been posted to HN at least twice recently: https://clemenswinter.com/2018/07/09/how-to-analyze-billions-of-records-per-second-on-a-single-desktop-pc/ https://clemenswinter.com/2018/07/09/how-to-analyze-billions... Question: Was the author subject to any restrictions on publication? If yes, did the author seek "permission" from the licensor to publish these findings? Excerpts from some of the licenses: 2.2. 32 Bit Kdb+ Software Use Restrictions (c) 32 Bit Kdb+ Software Evaluations. User shall not distribute or otherwise make available to any third party any report regarding the performance of the 32 Bit Kdb+ Software, 32 Bit Kdb+ Software benchmarks or any information from such a report unless User receives the express prior written consent of Kx to disseminate such report or information. kdb+ on demand - Personal Edition [64-bit] 1.3 Kdb+ On Demand Software Performance. End User shall not distribute or otherwise make available to any third party any report regarding the performance of the Kdb+ On Demand Software, Kdb+ On Demand Software benchmarks or any information from such a report unless End User receives the express, prior written consent of Kx to disseminate such report or information. This Kdb+ Software Academic Use License Agreement ("Agreement") is made between Kx Systems, Inc. ("Kx") and you, the University, or employee of the University ("End User") with respect to Kx's 64 bit Kdb+ Software and any related documentation that is made available to you in (jointly, the "Kdb+ Software"). You agree to use the Kdb+ Software under the terms and conditions set forth below. This Agreement is effective upon you clicking the "I agree" button below. 1. LISCENSE GRANTS [sic] 1.4 Kdb+ Software Evaluations. End User shall not distribute or otherwise make available to any third party any report regarding the performance of the Kdb+ Software, Kdb+ Software benchmarks or any information from such a report unless End User receives the express, prior written consent of Kx to disseminate such report or information. Kdb+ software end-user agreement: By accessing the Kdb+ Software via the Google platform, you are agreeing to be bound by these terms and conditions (which may be updated from time to time) and to the extent you are acting on behalf of a permitted organization that you have authority to act on their behalf and bind them to these terms and conditions. You may not access the Kdb+ Software if you are a direct competitor of Kx. 4. Benchmark Test Results. User agrees not to disclose benchmark, test or performance information regarding the Kdb+ Software to any third party except as explicitly authorized by Kx in writing.
• kashyapc 8y ago
  So, as expected, a colleague of mine pointed out—Imad Sousou from Intel's Open Source Technology Center clarified: We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here: http://bit.ly/2w9RjtM http://bit.ly/2w9RjtM . As an active member of the open source community, we continue to welcome all feedback and thank the community
• tripzilch 8y ago
  > I don’t know if Intel could have forseen the problem. Since some similar exploits have been discovered for AMD and ARM CPUs, the answer is probably “no”. the answer is they probably both should have. speculatively executing code that is time-sensitive to privileged data should have been caught. timing attacks on this level have been known for at least a decade. for that reason I don't quite believe that nobody at Intel (or AMD) was aware of the possibility of these attacks before anyone in the security industry published about it. they should have been more responsible instead of just waiting until it broke. everything about this saga adds up to economics, business and production reasons why 1) not enough people were paid to look for these kind of problems, 2) the microcode developers that might have become aware of potential issues didn't have a good avenue to raise them, 3) there seems to have been NO proper roadmap whatsoever at both of these (rather large) companies for responsibly addressing, fixing and patching mistakes of this level. the whole response seems to be completely ad hoc, like it was some kind of one-in-a-million act-of-god thing that nobody could have foreseen. it's not a super obscure bug. it's a side channel cache timing attack, the likes of which have been well-known for over a decade. if Intel and AMD both thought, during the past decade, "well we know about side channel cache timing attacks now, and this is probably the worst they'll ever get", they don't know quite an important rule about security: exploits only get worse, never better. that inaction definitely doesn't fall under "could not have foreseen".