6 ms·

So Intel failed to mitigate the vulnerability when it was first reported. Then they extended the embargo from May until November. And they still didn't fix it.

by Jonnax 7y ago

So Intel failed to mitigate the vulnerability when it was first reported. Then they extended the embargo from May until November. And they still didn't fix it. What's going on with Intel? Like they're going all in with lying in benchmarks against AMD and straight up forgetting what has been reported as security issues.

nootropicat 7y ago
https://www.glassdoor.com/Reviews/Employee-Review-Intel-Corporation-RVW12258812.htm https://www.glassdoor.com/Reviews/Employee-Review-Intel-Corp... >Company is dying and has no way to turn itself around. >Culture is a "go along to get along" / don't rock the boat. Most workers are very passive. Inclusive culture focused on internal "networking" rather than winning. A lot of make work going on, probably 25% extra headcount >Middle and upper management are in direct revolt against CEO and his plans. During my orientation (2nd quarter 2013) my orientation meeting was about how the CEO is wrong on his plans. >Advice to Management >Not much you can do. These problems are the result of near monopoly on PC CPUs for 20 years. This place is what Hewlett-Packard was probably like in 2000 (with the printer monopoly), the collapse is coming, but without starting over there is no way to fix it.
- wtallis 7y ago
  > This place is what Hewlett-Packard was probably like in 2000 (with the printer monopoly), the collapse is coming, but without starting over there is no way to fix it. Interestingly, that printer monopoly seems to be doing fine today, given how I have to go to hp.com to get drivers for my Samsung printer.
  - Jonnax 7y ago
    HP used to be much more. It was a real innovative company. But the interesting parts have been spun out like: Agillent and Keysight. HP Enterprise was also spun out.
    - wtallis 7y ago
      Other than splitting off HPE, the HP of 2000 was pretty much the HP of today. As far as I'm aware, they're still major players today in all the markets that they were major players in back then, and none of those HP or HPE business units had to go through a collapse and start over.
      - segfaultbuserr 7y ago
        Upvoted. Why downvote this comment? It does not have controversial political content nor personal attacks, it's just an OP's personal observation of HP's business performance. If someone disagrees, I'd like to hear you comment (I'm not the OP), rather than letting the comment sink to the bottom.
  - segfaultbuserr 7y ago
    Hewlett-Packard was an electronic engineering, semiconductor, and computing company from the beginning (the first product they sold was an audio distortion analyzer, it used a creative circuit to achieve high performance at minimum cost), they used to do serious and innovative R&D. There were the glorious days when Hewlett-Packard makes state-of-art test equipment and semiconductor devices, developed in-house enterprise computer systems like HP-UX system and PA-RISC CPUs, first-generation of scientific and programmable handheld calculators, etc., not just today's customer printers and laptops. e.g. I recently found a datasheet of an IC in an amateur radio gear, it were really the glorious days. Those chips with an HP logo (or a Motorola logo) are really cool. > The INA series of MMICs is fabricated using HP’s 25 GHz f_max, ISOSAT™-I silicon bipolar process which uses nitride self-alignment, submicrometer lithography, trench isolation, ion implantation, gold metallization and polyimide intermetal dielectric and scratch protection to achieve excellent performance, uniformity and reliability. Around 2000s, the EE & semiconductor department became an independent company, Agillent, and later Keysight. I think the last major innovation at HP was probably memristor that was supposed to be the next evolution of digital logic and storage, and HP claimed that it was developing a memristor computer system. Unfortunately, it failed to materialize.
    - Merrill 7y ago
      One of the last innovations at HP was the work on Explicitly Parallel Instruction Computing and Very Long Instruction Word architectures that led to the Itanium IA-64 processors produced by Intel. By putting the burden of scheduling parallelism on the compiler, does the EPIC design avoid speculative execution vulnerabilities, or did Intel implement Itanium with the same flaws?
    - willis936 7y ago
      HP? You mean Agilent-Keysight-HP? :p They’ve split up into companies that are widely successful in each of their individual fields.
      - gmueckl 7y ago
        The multiple splits and name changes didn't help brand recognition, at least on my end. I remember HP lab equipment being highly impressive and warranting its price. But I consistently fail to make the connection that Agilent amd Keysight products are the successors to that.
krageon 7y ago
Intel has become big and rich and has stopped (or perhaps never was) being very responsible. Given their fairly entrenched position in the industry, it's doubtful this strategy will impact their profit all that much and therefore we can expect to see more of this behaviour in the future.
- the_duke 7y ago
  Thankfully AMD is making serious headway and will continue to take market share from Intel. It will take time but Intel should begin to feel the sting soon.
  - mywacaday 7y ago
    I'm nearly 20 years in mid to large companies, I've never seen an AMD cpu on a desktop, laptop or server. Its almost like nobody ever gets fired for buying Intel.
    - alecmg 7y ago
      So far there was no reason to fire for that. The only bad period was where AMD Opteron gained a big market share in servers while Intel was doing Pentium 4 Netburst crap.
    - kjs3 7y ago
      I'm 30+ years in. AMD shipped huge numbers of 8086/8088s as a second-source; you might have had one and not known it. But I'm guessing that's not what you mean. :-) There was a good bit of time where Opterons where everywhere on servers, including things like the whole Sun x86 line. At one gig we had datacenters full of IBM blade servers stuffed with dual Opteron boards; they were a big success in the market. I know at one point another gig's non-US folks had significant installed base of AMD-based Fujitsu servers. Didn't see as much on the desktop/laptop side, though I did carry a AMD-based Thinkpad for a short while. Apparently HP sold a successful, low-end, AMD-based business desktop. YMMV...I think it's a matter of 'I haven't seen any tigers in my back yard, therefore I doubt they exist'.
chooseaname 7y ago
A focus on managing by spreadsheet instead of focusing on good solid engineering, maybe?
coldtea 7y ago
>So Intel failed to mitigate the vulnerability when it was first reported. Then they extended the embargo from May until November. And they still didn't fix it. The assumption being that they could in the time given, but are sitting on their hands?
- wolf550e 7y ago
  No. This timeline shows incompetence, not sitting on their hands: https://mdsattacks.com/#ng-full-story https://mdsattacks.com/#ng-full-story
  - coldtea 7y ago
    Incompetence as in "they're incompetent engineers", and if so, compared to what baseline? Or incompetence in as "they weren't capable of doing it"? The latter is very probable. The former could underestimate the difficulty of such fixes...
    - yifanl 7y ago
      The two statements are identical, competence is always within a given context.
      - diffeomorphism 7y ago
        No, the second is "incapable" and suggests that even a "great" engineer could not have done it. The first one says that a "competent" engineer could have. Big difference.
        yifanl 7y ago
        A great engineer can still be incompetent in the face of a difficult (or poorly specced) task.
        deleted 7y ago
        [deleted]
nolok 7y ago
Zen and Zen+ may have been strong competitors that Intel was unprepared for, but at least they were still competing, notably in per core performance. Now Zen 2 is out and Intel is taking a beating in every category, from price to power usage to multi core performance to single core performance and everything in between. Meanwhile it became clear that a decent part of Intel's per core advantage was because of massive shortcuts they took, notably security wise, and so fixing those security holes takes away the performance. In that situation, I doubt management at Intel is eager to take out yet another one of their shortcut. Intel needs a win, but they are not at all in the state of mind necessary to achieve one...
IntelThrowaway 7y ago
One of the problems with Intel culture - especially under BK was that the philosophy was "Focus on our key goals to the exclusion of everything else". It was meant to keep focus and ensure we moved quickly. The problem with that is it meant we were entirely unresponsive. It doesn't matter if something important has come up because you've already agreed what the priority is, you've already committed to what you're going to do. So even if something does come up, communicating that problem to the team that needs to fix it is impossible because you'll get ZBB'd (if we do this, we will drop that). Then once you've got engineering to commit, the bureaucracy won't let you just release anything so you need to line up into a release process. I'm sure no one intended to mislead, but organisationally Intel just isn't designed to fix bugs. It doesn't have a process to respond to issues.
- jhalstead 7y ago
  Dumb question: Can you clarify what ZBB'd means in this context? I've never seen it before. There's a wiki page [0] with various meanings for the abbreviation, but nothing seemed to fit. Maybe Zero-based budgeting? [0] https://en.m.wikipedia.org/wiki/ZBB https://en.m.wikipedia.org/wiki/ZBB
  - epsilon_greedy 7y ago
    Zero-based budgeting. It effectively means that a project is no longer getting funded or staffed and is therefore dead.
    - nieve 7y ago
      I have to wonder how many bitter Pyrrhic victory jokes get made by victims of poor implementation based on the creator's last name - Pyrrh. I've seen too many companies destroyed by superficially attractive budgeting schemes, even with how much tech has started to acknowledge perverse incentives they seem to get overlooked. The worst I had direct experience with was a company where they moved to all income being credited to marketing & bizdev and all other parts of the company being treated as losses to be minimized. We were both advertising supported (and thus needed content to sell anything) and had professional products that required analysts, but they when the market started looking rougher they kept the sales & ad people and concentrated layoffs on people who produced things or ran the infrastructure. Ultra-simplified bookkeeping interpreted through the lens of too much coke nearly destroyed them. The dotcom bubble was a very strange time.
dd36 7y ago
That seems to be the new corporate PR move.
rrss 7y ago
> going all in with lying in benchmarks against AMD I'm assuming this is referencing the "intentionally misleading benchmarks" piece in servethehome. It's worth reading the follow up, in which the author discovers their biggest complaint (older version doesn't have avx2 enabled by default on zen2) was not an issue because Intel manually enabled avx2. https://www.servethehome.com/update-to-the-intel-xeon-platinum-9282-gromacs-benchmarks-piece/ https://www.servethehome.com/update-to-the-intel-xeon-platin...
- nolok 7y ago
  They request all benchmark done with SMT off, they insist on doing their bench without the security fixes for Spectres/Meltdown applied, they use dubious TDP counting, ... AMD has its fair share of issue in their own self published benchmarks, but at least when third party publish they're not forced to cripple other companies' chips.
  - yvdriess 7y ago
    As addressed, the benchmarks in question were for HPC, where turning off SMT and running without mitigations is standard.

by Jonnax 7y ago

nootropicat 7y ago

https://www.glassdoor.com/Reviews/Employee-Review-Intel-Corporation-RVW12258812.htm https://www.glassdoor.com/Reviews/Employee-Review-Intel-Corp... >Company is dying and has no way to turn itself around. >Culture is a "go along to get along" / don't rock the boat. Most workers are very passive. Inclusive culture focused on internal "networking" rather than winning. A lot of make work going on, probably 25% extra headcount >Middle and upper management are in direct revolt against CEO and his plans. During my orientation (2nd quarter 2013) my orientation meeting was about how the CEO is wrong on his plans. >Advice to Management >Not much you can do. These problems are the result of near monopoly on PC CPUs for 20 years. This place is what Hewlett-Packard was probably like in 2000 (with the printer monopoly), the collapse is coming, but without starting over there is no way to fix it.

wtallis 7y ago
> This place is what Hewlett-Packard was probably like in 2000 (with the printer monopoly), the collapse is coming, but without starting over there is no way to fix it. Interestingly, that printer monopoly seems to be doing fine today, given how I have to go to hp.com to get drivers for my Samsung printer.
- Jonnax 7y ago
  HP used to be much more. It was a real innovative company. But the interesting parts have been spun out like: Agillent and Keysight. HP Enterprise was also spun out.
  - wtallis 7y ago
    Other than splitting off HPE, the HP of 2000 was pretty much the HP of today. As far as I'm aware, they're still major players today in all the markets that they were major players in back then, and none of those HP or HPE business units had to go through a collapse and start over.
    - segfaultbuserr 7y ago
      Upvoted. Why downvote this comment? It does not have controversial political content nor personal attacks, it's just an OP's personal observation of HP's business performance. If someone disagrees, I'd like to hear you comment (I'm not the OP), rather than letting the comment sink to the bottom.
- segfaultbuserr 7y ago
  Hewlett-Packard was an electronic engineering, semiconductor, and computing company from the beginning (the first product they sold was an audio distortion analyzer, it used a creative circuit to achieve high performance at minimum cost), they used to do serious and innovative R&D. There were the glorious days when Hewlett-Packard makes state-of-art test equipment and semiconductor devices, developed in-house enterprise computer systems like HP-UX system and PA-RISC CPUs, first-generation of scientific and programmable handheld calculators, etc., not just today's customer printers and laptops. e.g. I recently found a datasheet of an IC in an amateur radio gear, it were really the glorious days. Those chips with an HP logo (or a Motorola logo) are really cool. > The INA series of MMICs is fabricated using HP’s 25 GHz f_max, ISOSAT™-I silicon bipolar process which uses nitride self-alignment, submicrometer lithography, trench isolation, ion implantation, gold metallization and polyimide intermetal dielectric and scratch protection to achieve excellent performance, uniformity and reliability. Around 2000s, the EE & semiconductor department became an independent company, Agillent, and later Keysight. I think the last major innovation at HP was probably memristor that was supposed to be the next evolution of digital logic and storage, and HP claimed that it was developing a memristor computer system. Unfortunately, it failed to materialize.
  - Merrill 7y ago
    One of the last innovations at HP was the work on Explicitly Parallel Instruction Computing and Very Long Instruction Word architectures that led to the Itanium IA-64 processors produced by Intel. By putting the burden of scheduling parallelism on the compiler, does the EPIC design avoid speculative execution vulnerabilities, or did Intel implement Itanium with the same flaws?
  - willis936 7y ago
    HP? You mean Agilent-Keysight-HP? :p They’ve split up into companies that are widely successful in each of their individual fields.
    - gmueckl 7y ago
      The multiple splits and name changes didn't help brand recognition, at least on my end. I remember HP lab equipment being highly impressive and warranting its price. But I consistently fail to make the connection that Agilent amd Keysight products are the successors to that.

krageon 7y ago

Intel has become big and rich and has stopped (or perhaps never was) being very responsible. Given their fairly entrenched position in the industry, it's doubtful this strategy will impact their profit all that much and therefore we can expect to see more of this behaviour in the future.

the_duke 7y ago
Thankfully AMD is making serious headway and will continue to take market share from Intel. It will take time but Intel should begin to feel the sting soon.
- mywacaday 7y ago
  I'm nearly 20 years in mid to large companies, I've never seen an AMD cpu on a desktop, laptop or server. Its almost like nobody ever gets fired for buying Intel.
  - alecmg 7y ago
    So far there was no reason to fire for that. The only bad period was where AMD Opteron gained a big market share in servers while Intel was doing Pentium 4 Netburst crap.
  - kjs3 7y ago
    I'm 30+ years in. AMD shipped huge numbers of 8086/8088s as a second-source; you might have had one and not known it. But I'm guessing that's not what you mean. :-) There was a good bit of time where Opterons where everywhere on servers, including things like the whole Sun x86 line. At one gig we had datacenters full of IBM blade servers stuffed with dual Opteron boards; they were a big success in the market. I know at one point another gig's non-US folks had significant installed base of AMD-based Fujitsu servers. Didn't see as much on the desktop/laptop side, though I did carry a AMD-based Thinkpad for a short while. Apparently HP sold a successful, low-end, AMD-based business desktop. YMMV...I think it's a matter of 'I haven't seen any tigers in my back yard, therefore I doubt they exist'.

chooseaname 7y ago

A focus on managing by spreadsheet instead of focusing on good solid engineering, maybe?

coldtea 7y ago

>So Intel failed to mitigate the vulnerability when it was first reported. Then they extended the embargo from May until November. And they still didn't fix it. The assumption being that they could in the time given, but are sitting on their hands?

wolf550e 7y ago
No. This timeline shows incompetence, not sitting on their hands: https://mdsattacks.com/#ng-full-story https://mdsattacks.com/#ng-full-story
- coldtea 7y ago
  Incompetence as in "they're incompetent engineers", and if so, compared to what baseline? Or incompetence in as "they weren't capable of doing it"? The latter is very probable. The former could underestimate the difficulty of such fixes...
  - yifanl 7y ago
    The two statements are identical, competence is always within a given context.
    - diffeomorphism 7y ago
      No, the second is "incapable" and suggests that even a "great" engineer could not have done it. The first one says that a "competent" engineer could have. Big difference.
      - yifanl 7y ago
        A great engineer can still be incompetent in the face of a difficult (or poorly specced) task.
        deleted 7y ago
        [deleted]

nolok 7y ago

Zen and Zen+ may have been strong competitors that Intel was unprepared for, but at least they were still competing, notably in per core performance. Now Zen 2 is out and Intel is taking a beating in every category, from price to power usage to multi core performance to single core performance and everything in between. Meanwhile it became clear that a decent part of Intel's per core advantage was because of massive shortcuts they took, notably security wise, and so fixing those security holes takes away the performance. In that situation, I doubt management at Intel is eager to take out yet another one of their shortcut. Intel needs a win, but they are not at all in the state of mind necessary to achieve one...

IntelThrowaway 7y ago

One of the problems with Intel culture - especially under BK was that the philosophy was "Focus on our key goals to the exclusion of everything else". It was meant to keep focus and ensure we moved quickly. The problem with that is it meant we were entirely unresponsive. It doesn't matter if something important has come up because you've already agreed what the priority is, you've already committed to what you're going to do. So even if something does come up, communicating that problem to the team that needs to fix it is impossible because you'll get ZBB'd (if we do this, we will drop that). Then once you've got engineering to commit, the bureaucracy won't let you just release anything so you need to line up into a release process. I'm sure no one intended to mislead, but organisationally Intel just isn't designed to fix bugs. It doesn't have a process to respond to issues.

jhalstead 7y ago
Dumb question: Can you clarify what ZBB'd means in this context? I've never seen it before. There's a wiki page [0] with various meanings for the abbreviation, but nothing seemed to fit. Maybe Zero-based budgeting? [0] https://en.m.wikipedia.org/wiki/ZBB https://en.m.wikipedia.org/wiki/ZBB
- epsilon_greedy 7y ago
  Zero-based budgeting. It effectively means that a project is no longer getting funded or staffed and is therefore dead.
  - nieve 7y ago
    I have to wonder how many bitter Pyrrhic victory jokes get made by victims of poor implementation based on the creator's last name - Pyrrh. I've seen too many companies destroyed by superficially attractive budgeting schemes, even with how much tech has started to acknowledge perverse incentives they seem to get overlooked. The worst I had direct experience with was a company where they moved to all income being credited to marketing & bizdev and all other parts of the company being treated as losses to be minimized. We were both advertising supported (and thus needed content to sell anything) and had professional products that required analysts, but they when the market started looking rougher they kept the sales & ad people and concentrated layoffs on people who produced things or ran the infrastructure. Ultra-simplified bookkeeping interpreted through the lens of too much coke nearly destroyed them. The dotcom bubble was a very strange time.

dd36 7y ago

That seems to be the new corporate PR move.

rrss 7y ago

> going all in with lying in benchmarks against AMD I'm assuming this is referencing the "intentionally misleading benchmarks" piece in servethehome. It's worth reading the follow up, in which the author discovers their biggest complaint (older version doesn't have avx2 enabled by default on zen2) was not an issue because Intel manually enabled avx2. https://www.servethehome.com/update-to-the-intel-xeon-platinum-9282-gromacs-benchmarks-piece/ https://www.servethehome.com/update-to-the-intel-xeon-platin...

nolok 7y ago
They request all benchmark done with SMT off, they insist on doing their bench without the security fixes for Spectres/Meltdown applied, they use dubious TDP counting, ... AMD has its fair share of issue in their own self published benchmarks, but at least when third party publish they're not forced to cripple other companies' chips.
- yvdriess 7y ago
  As addressed, the benchmarks in question were for HPC, where turning off SMT and running without mitigations is standard.