4 ms·
> AMD unexpectedly publish patches, earlier than an agreed embargo date. > As the fix is now public, we propose privately notifying major distributions that th
by sedatk 3y ago
> AMD unexpectedly publish patches, earlier than an agreed embargo date.
> As the fix is now public, we propose privately notifying major distributions that they should begin preparing updated firmware packages.
AMD had to drop the ball somewhere didn't it.
- klyrs 3y agoIt's good that they published patches early, isn't it?
- robryk 3y agoYou'd want the delay between first publication of X and the microcode update making its way into releases of OSes to be smallest, for various values of X (mention of a vulnerability, microcode patch, description of vulnerability, PoC). Making various OS releasers aware that a microcode patch that fixes a vulnerability will be published on a given date before that date decreases that for most values of X.
- taviso 3y agoYes. It was unexpected, but good. Not a complaint.
- sedatk 3y agoUh, okay. I thought the embargo date was set so you could have enough time to inform the distros. Not the case, then.
- underdeserver 3y agoWon't that theoretically allow malicious actors to study the patch and exploit the now 1-day vulnerability? Not that I think it's realistic to develop an exploit and gain real value in three days, but theoretically, if all parties had taken more than three days to distribute and apply the patches?
- deleted 3y ago[deleted]
- mort96 3y agoPublishing patches early is good. Publishing patches unexpectedly before embargo isn't.
- cubefox 3y agoThe second sentence seems to contradict the first.