4 ms·

That does not address the stupid embargo on involved linux developers to speak about it to each other.

• mjevans 8y ago
  It shows that legal and marketing (PR spin) were prominent on the security decision tree rather than security minded individuals.
  • MaxBarraclough 8y ago
    It's a real pity that Company caught putting PR before customers' interests so rarely causes a backlash, even when it's plain as day.
    • PopsiclePete 8y ago
      Don't hate the player, hate the game. It's how the entire economic model is setup. For a publicly traded company, stock price matters above all else. Stock goes down, people lose their jobs. PR departments' job consists of damage control and limiting the impact of bad news on the stock. I'm not aware of any company that would've done something different. People actually admitting fault/guilt, publicly, means that heads are getting chopped off. If you want to see companies' behavior change, we have to change our entire model on what "economic performance" means, and whether it's even something worth pursuing above all else.
      • MaxBarraclough 8y ago
        I don't think that's really it. Some misbehaviours result in PR disasters, but for whatever reason, no-one ever calls-out a company specifically for putting PR over customers' interests.
    • hansendc 8y ago
      Disclaimer: I work on Linux at Intel. FWIW, I don't think PR had anything to do with this. Without arguing the merits of embargoes, the goal of them is to give the good guys a head start before the bad guys. But, if you tell too many good guys, the assumption is that the bad guys find out. So, you try to tell as few good guys as possible. This was (from my blatantly biased perspective) an honest, but imperfect attempt at keeping the bad guys from finding out. A lot of lessons have been learned since this, and the group of good guys involved in recent issues has been much more comprehensive than with the original Spectre/Meltdown bits. I think Greg was alluding to this when he said "Intel has gotten better at this."
      • blihp 8y ago
        The part that I find amazing about this is that Greg and Linus weren't at the top of the list of people contacted to ask 'this is a very sensitive issue and we'd like to work with you to figure out who we need to get involved in this' from a Linux standpoint. Intel has had people working on Linux support for many years now so it's not like they didn't have people on the payroll who knew the landscape and couldn't readily figure out who to contact. This reeks of incompetence at the senior management levels of Intel.
        • cookiecaper 8y ago
          Greg and Linus are also some of the most visible participants, and as far as I understand, neither is considered particularly expert in the platform intricacies that would be involved in mitigating something like Spectre. Disclosing vulns to high-profile targets is a risky practice; their activity, both public and private, attracts a lot of attention. It makes sense to avoid that risk if possible.
• hansendc 8y ago
  Disclaimer: I work on Linux at Intel. I'm biased, of course. But, I think things are much better now. We have ways of having relatively "normal" conversations about these things where a broad set of community folks are involved. It's not perfect, but it's way better than it was a year ago. The embargo was really painful to work with, even for folks like myself who were inside Intel during the whole thing. I'm used to being able to ask folks for help and to lean on the incredible knowledge of the kernel community. For Meltdown, I was much more on my own than I was comfortable with. It wasn't fun.