7 ms·

My thougt based on the HN headline "Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed" (after having read the article, of course): Doesn

My thougt based on the HN headline "Intel Publishes Microcode Patches, No Benchmarking or Comparison Allowed" (after having read the article, of course): Doesn't this show that it is time for someone to set up some kind of "ScienceLeaks" website, where scientists can upload research (results, papers, ...) anonymously which they are are not allowed to do legally because of various such "research-restricting" laws. --- UPDATE: Before people ask the potential question how the researchers are supposed to get their proper credit - my consideration is the following: Each of the researchers signs the paper with their own "public" key of a public-private key pair. This signature is uploaded as part of the paper upload. The "public" key is nevertheless kept secret by the researchers. When the legal risk is over and the researchers want to disclose their contribution, they simply make their "public" key really public. This way, anyboy can change that the signature that was uploaded from beginning on, indeed belong to this public key and thus to the respective researcher.

justinclift 8y ago
Sleazy marketers would be all over that. :/
- executesorder66 8y ago
  If they show reproducible results, then I don't see a problem. If they don't, well then you know it is either dodgy or not rigorous enough to take seriously.
  - justinclift 8y ago
    They'd definitely show reproducible results. eg either get their mates to submit matching fakes ones, or just submit an extra set themselves after slight tweaking That being said, as soon as someone with a clue comes along + tries them out and finds it's bogus... that would lead into potentially weird territory too. eg the dodgy submitters likely attempting to discredit the er... whistleblower(?). Seems like a re-run of an old story. :/
StavrosK 8y ago
That's not how you do signing at all. You just use your private key to sign something, publish the public key for verification, and, when you want to reveal yourself, you just sign "I am X" with that key.
- wolfgke 8y ago
  OK, thanks for the correction. Much better, indeed. :-)
  - StavrosK 8y ago
    No problem! It's a very good strategy, it's what someone who wanted to remain anonymous would use.
chmod775 8y ago
Or... just have people outside the US do the benchmarking. These kinds of clauses are likely effectively null, void or unenforcable in any country that has decent consumer protection laws or laws concerning anti-competetive practices. You also can't just go and write whatever into a document that already has weak legal footing in many places - and especially not after I purchased your defective product. This shit won't hold for a minute in court.
verbify 8y ago
Why would the legal risk ever be over?
- wolfgke 8y ago
  > Why would the legal risk ever be over? I can imagine some scenarios: - A company is bought by another one which has a different legal policy and voids some legal restrictions even retroactively - By some other way, the "illegal" knowledge in the paper became "public knowledge", so that company lawyers will have a hard(er) time convincing a judge that the respective paper is of any danger and thus the author to be prosecuted. For example: After these microcode patches, people will of course privately do benchmark the performance differences. So some years later, the order of performance differences are kind of public knowledge. - With time, companies have a much less legal interest to sue people for disclosre. As long as there is a high commercial interest, companies can be very "sue-happy". On the other hand, each of these lawsuits is a PR risk for the company. If the respective product becomes outdated, the ecomonical advantage of a lawsuite is much less than the probable PR loss. - The researcher now (later on) lives in a different country that has a different legal system where there is much less legal risk. For example, in Germany, it is very restricted what can be included in the general business terms (in opposite to the USA). In all of these cases, it can become much less legally dangerous to disclose the real identity of the author. On the other hand, there exists an incentive (academic credit) to do so.
giancarlostoro 8y ago
> Doesn't this show that it is time for someone to set up some kind of "ScienceLeaks" website, where scientists can upload research (results, papers, ...) anonymously which they are are not allowed to do legally because of various such "research-restricting" laws. I don't go there since 2008 but why not just wikileaks?
- bearjaws 8y ago
  Wikileaks is a Russian propaganda machine. They are only interested in Anti-America leaks, not all leaks.
  - wolfgke 8y ago
    > Wikileaks is a Russian propaganda machine. > They are only interested in Anti-America leaks, not all leaks. Everybody should make their own judgement on the political bias of Wikileaks (which is, in my personal opinion, a very good reason why monopolies are typically bad; in other words: there is a demand on multiple independent Wikileaks-like websites), but the statement that Wikileaks is only interested in Anti-America leaks does not hold in my opinion. See for example the following leak about Russia's mass surveillance apparatus: > https://techcrunch.com/2017/09/19/wikileaks-releases-documents-it-claims-detail-russia-mass-surveillance-apparatus/ https://techcrunch.com/2017/09/19/wikileaks-releases-documen... Or let us quote > https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikileaks_ever_published_anything_against/dc6lwnk/ https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikil... "They released Syrian/Russian email exchanges, I don't know if it led to anything extremely controversial. In an interview, Assange said the main reason they don't receive leaks from Russian whistle-blowers is that the whistle-blowers prefer to hand over documents to Russian-speaking leaking organization. And Wikileaks doesn't have Russian-speakers in their organization. You can tell your friend that if he or she wants Wikileaks to release damaging Russian documents, then he or she should hack the Russian government and give what they find to WL." Or have a look at > https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikileaks_ever_published_anything_against/dc6sd1q/ https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikil... On > https://www.reddit.com/r/IAmA/comments/5c8u9l/we_are_the_wikileaks_staff_despite_our_editor/d9v5m6f/ https://www.reddit.com/r/IAmA/comments/5c8u9l/we_are_the_wik... you can find a list of various counter-arguments to common criticisms of WikiLeaks.
mcv 8y ago
> Doesn't this show that it is time for someone to set up some kind of "ScienceLeaks" website Good idea, but I doubt it's necessary here. I'm fairly sure this sort of EULA clause is unenforceable in many jurisdictions. Run the benchmarks in a country where they are legal.
- gnulinux 8y ago
  If that's the case would it be ok to publish these results in US-based websites such as Phoronix, even if they're done by other country's citizens in that other country?
  - mcv 8y ago
    If Phoronix never agreed to the license, then I can't see how that wouldn't be legal. And otherwise it's going to be a good year for Europe-based benchmarkers.
rsync 8y ago
"Doesn't this show that it is time for someone to set up some kind of ..." I don't think this is necessary ... I think "circumventing" this benchmarking restriction is as simple as having one person purchase an Intel CPU and just drop it on the ground somewhere ... and have another person pick it up off of the street (no purchase, no EULA, no agreement entered into) and decide to benchmark the found item against other items. "I found a chip on the ground that had these markings and numbers on it and here is how it performed against an AMD model."
- wolfgke 8y ago
  I think that one has to apply the microcode patches after startup. For this, you have to obtain the microcode patch file from somewhere. So I am not sure whether this "legal hack" will work.
  - appleflaxen 8y ago
    why can't you drop a computer with the microcode patches already applied?
topspin 8y ago
That's not the way. The tech press isn't powerless here. The media that has been performing such benchmarks for decades and have thus earned a large and faithful audience can organize and simultaneously publish the relevant benchmarks in the US, complete with an unapologetic disclosure right at the top as to the why this is happening. Put Intel into the position of suing every significant member of the US tech media and create a 1st amendment case, or perhaps try to single out some member and create a living martyr to which we can offer our generous gofundme legal defense contributions over the decade it takes to progress through the courts. Either way Intel creates a PR disaster for itself. Sack up and call their bluff. There are MILLIONS of people that will stand behind that courage. At some point the share holders will feel it and this nasty crap will end.
- bluGill 8y ago
  The press can just give intel a "Don't buy" rating with a comment that intel has something to hide, we don't know what but you would be a fool to even consider them when you can't know if they are any good. Technically I can't even show the latest intel is faster than a old i386 that I'm finally ready to replace, while I can show the AMD is better.
- pas 8y ago
  How is the 1st Amendment relevant when private parties deal with each other? (As far as I know, it's not.) It's contract law and tort law that's relevant. Intel's defective product, Intel's ToS, and maybe fair use. (As the tester could get the patch without an explicit license and try to claim fair use.)
agwa 8y ago
> UPDATE: Before people ask the potential question how the researchers are supposed to get their proper credit - my consideration is the following: Each of the researchers signs the paper with their own "public" key of a public-private key pair. This signature is uploaded as part of the paper upload. The "public" key is nevertheless kept secret by the researchers. > When the legal risk is over and the researchers want to disclose their contribution, they simply make their "public" key really public. This way, anyboy can change that the signature that was uploaded from beginning on, indeed belong to this public key and thus to the respective researcher. Commonly-used public key signature systems (RSA, ECDSA) do not provide the security properties necessary for this. Someone else who wants to claim credit for the research could cook up their own key pair that successfully validates the message and signature. This is called a duplicate signature key selection attack (https://www.agwa.name/blog/post/duplicate_signature_key_selection_attack_in_lets_encrypt https://www.agwa.name/blog/post/duplicate_signature_key_sele...)
- wolfgke 8y ago
  After chmod775's comment (https://news.ycombinator.com/item?id=17825777 https://news.ycombinator.com/item?id=17825777), I already suspected something into that direction. Thanks for the independent confirmation.

justinclift 8y ago

Sleazy marketers would be all over that. :/

executesorder66 8y ago
If they show reproducible results, then I don't see a problem. If they don't, well then you know it is either dodgy or not rigorous enough to take seriously.
- justinclift 8y ago
  They'd definitely show reproducible results. eg either get their mates to submit matching fakes ones, or just submit an extra set themselves after slight tweaking That being said, as soon as someone with a clue comes along + tries them out and finds it's bogus... that would lead into potentially weird territory too. eg the dodgy submitters likely attempting to discredit the er... whistleblower(?). Seems like a re-run of an old story. :/

StavrosK 8y ago

That's not how you do signing at all. You just use your private key to sign something, publish the public key for verification, and, when you want to reveal yourself, you just sign "I am X" with that key.

wolfgke 8y ago
OK, thanks for the correction. Much better, indeed. :-)
- StavrosK 8y ago
  No problem! It's a very good strategy, it's what someone who wanted to remain anonymous would use.

chmod775 8y ago

Or... just have people outside the US do the benchmarking. These kinds of clauses are likely effectively null, void or unenforcable in any country that has decent consumer protection laws or laws concerning anti-competetive practices. You also can't just go and write whatever into a document that already has weak legal footing in many places - and especially not after I purchased your defective product. This shit won't hold for a minute in court.

verbify 8y ago

Why would the legal risk ever be over?

wolfgke 8y ago
> Why would the legal risk ever be over? I can imagine some scenarios: - A company is bought by another one which has a different legal policy and voids some legal restrictions even retroactively - By some other way, the "illegal" knowledge in the paper became "public knowledge", so that company lawyers will have a hard(er) time convincing a judge that the respective paper is of any danger and thus the author to be prosecuted. For example: After these microcode patches, people will of course privately do benchmark the performance differences. So some years later, the order of performance differences are kind of public knowledge. - With time, companies have a much less legal interest to sue people for disclosre. As long as there is a high commercial interest, companies can be very "sue-happy". On the other hand, each of these lawsuits is a PR risk for the company. If the respective product becomes outdated, the ecomonical advantage of a lawsuite is much less than the probable PR loss. - The researcher now (later on) lives in a different country that has a different legal system where there is much less legal risk. For example, in Germany, it is very restricted what can be included in the general business terms (in opposite to the USA). In all of these cases, it can become much less legally dangerous to disclose the real identity of the author. On the other hand, there exists an incentive (academic credit) to do so.

giancarlostoro 8y ago

> Doesn't this show that it is time for someone to set up some kind of "ScienceLeaks" website, where scientists can upload research (results, papers, ...) anonymously which they are are not allowed to do legally because of various such "research-restricting" laws. I don't go there since 2008 but why not just wikileaks?

bearjaws 8y ago
Wikileaks is a Russian propaganda machine. They are only interested in Anti-America leaks, not all leaks.
- wolfgke 8y ago
  > Wikileaks is a Russian propaganda machine. > They are only interested in Anti-America leaks, not all leaks. Everybody should make their own judgement on the political bias of Wikileaks (which is, in my personal opinion, a very good reason why monopolies are typically bad; in other words: there is a demand on multiple independent Wikileaks-like websites), but the statement that Wikileaks is only interested in Anti-America leaks does not hold in my opinion. See for example the following leak about Russia's mass surveillance apparatus: > https://techcrunch.com/2017/09/19/wikileaks-releases-documents-it-claims-detail-russia-mass-surveillance-apparatus/ https://techcrunch.com/2017/09/19/wikileaks-releases-documen... Or let us quote > https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikileaks_ever_published_anything_against/dc6lwnk/ https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikil... "They released Syrian/Russian email exchanges, I don't know if it led to anything extremely controversial. In an interview, Assange said the main reason they don't receive leaks from Russian whistle-blowers is that the whistle-blowers prefer to hand over documents to Russian-speaking leaking organization. And Wikileaks doesn't have Russian-speakers in their organization. You can tell your friend that if he or she wants Wikileaks to release damaging Russian documents, then he or she should hack the Russian government and give what they find to WL." Or have a look at > https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikileaks_ever_published_anything_against/dc6sd1q/ https://www.reddit.com/r/WikiLeaks/comments/5mv07m/has_wikil... On > https://www.reddit.com/r/IAmA/comments/5c8u9l/we_are_the_wikileaks_staff_despite_our_editor/d9v5m6f/ https://www.reddit.com/r/IAmA/comments/5c8u9l/we_are_the_wik... you can find a list of various counter-arguments to common criticisms of WikiLeaks.

mcv 8y ago

> Doesn't this show that it is time for someone to set up some kind of "ScienceLeaks" website Good idea, but I doubt it's necessary here. I'm fairly sure this sort of EULA clause is unenforceable in many jurisdictions. Run the benchmarks in a country where they are legal.

gnulinux 8y ago
If that's the case would it be ok to publish these results in US-based websites such as Phoronix, even if they're done by other country's citizens in that other country?
- mcv 8y ago
  If Phoronix never agreed to the license, then I can't see how that wouldn't be legal. And otherwise it's going to be a good year for Europe-based benchmarkers.

rsync 8y ago

"Doesn't this show that it is time for someone to set up some kind of ..." I don't think this is necessary ... I think "circumventing" this benchmarking restriction is as simple as having one person purchase an Intel CPU and just drop it on the ground somewhere ... and have another person pick it up off of the street (no purchase, no EULA, no agreement entered into) and decide to benchmark the found item against other items. "I found a chip on the ground that had these markings and numbers on it and here is how it performed against an AMD model."

wolfgke 8y ago
I think that one has to apply the microcode patches after startup. For this, you have to obtain the microcode patch file from somewhere. So I am not sure whether this "legal hack" will work.
- appleflaxen 8y ago
  why can't you drop a computer with the microcode patches already applied?

topspin 8y ago

That's not the way. The tech press isn't powerless here. The media that has been performing such benchmarks for decades and have thus earned a large and faithful audience can organize and simultaneously publish the relevant benchmarks in the US, complete with an unapologetic disclosure right at the top as to the why this is happening. Put Intel into the position of suing every significant member of the US tech media and create a 1st amendment case, or perhaps try to single out some member and create a living martyr to which we can offer our generous gofundme legal defense contributions over the decade it takes to progress through the courts. Either way Intel creates a PR disaster for itself. Sack up and call their bluff. There are MILLIONS of people that will stand behind that courage. At some point the share holders will feel it and this nasty crap will end.

bluGill 8y ago
The press can just give intel a "Don't buy" rating with a comment that intel has something to hide, we don't know what but you would be a fool to even consider them when you can't know if they are any good. Technically I can't even show the latest intel is faster than a old i386 that I'm finally ready to replace, while I can show the AMD is better.
pas 8y ago
How is the 1st Amendment relevant when private parties deal with each other? (As far as I know, it's not.) It's contract law and tort law that's relevant. Intel's defective product, Intel's ToS, and maybe fair use. (As the tester could get the patch without an explicit license and try to claim fair use.)

agwa 8y ago

> UPDATE: Before people ask the potential question how the researchers are supposed to get their proper credit - my consideration is the following: Each of the researchers signs the paper with their own "public" key of a public-private key pair. This signature is uploaded as part of the paper upload. The "public" key is nevertheless kept secret by the researchers. > When the legal risk is over and the researchers want to disclose their contribution, they simply make their "public" key really public. This way, anyboy can change that the signature that was uploaded from beginning on, indeed belong to this public key and thus to the respective researcher. Commonly-used public key signature systems (RSA, ECDSA) do not provide the security properties necessary for this. Someone else who wants to claim credit for the research could cook up their own key pair that successfully validates the message and signature. This is called a duplicate signature key selection attack (https://www.agwa.name/blog/post/duplicate_signature_key_selection_attack_in_lets_encrypt https://www.agwa.name/blog/post/duplicate_signature_key_sele...)

wolfgke 8y ago
After chmod775's comment (https://news.ycombinator.com/item?id=17825777 https://news.ycombinator.com/item?id=17825777), I already suspected something into that direction. Thanks for the independent confirmation.