3 ms·
Quitely disabling it is also a big risk. Because you're signalling that in all probablity you were aware of the severity of the issue; Enough so that you took s
by BartjeD 2y ago
Quitely disabling it is also a big risk. Because you're signalling that in all probablity you were aware of the severity of the issue; Enough so that you took steps to patch it.
If you don't disclose the vulnerability then affected parties cannot start taking countermeasures, except out of sheer paranoia.
Disclosing a vulnerability is a way shift liability onto the end user. You didn't update? Then don't complain. Only rarely do disclosures lead to product liability. I don't remember this (liability) happening with Meltdown and Spectre either. So wouldn't assume this is AMD being secretive.
- deleted 2y ago[deleted]
- wtallis 2y agoPlease don't post duplicate comments like this. Your first comment (https://news.ycombinator.com/item?id=42287118 https://news.ycombinator.com/item?id=42287118) was fine but spamming a thread with copy-and-pasted comments just hurts the signal to noise ratio.
- alexnewman 2y agoIm confused would you be ok if he's addressing the same point in the forum with a slightly different sentence?
- wtallis 2y agoAny threaded discussion carries the risk of different subthreads ending up in the same place. The simplest solution is to just not post twice, and trust that the reader can read the rest of the thread; HN threads usually don't get long enough for good comments to get too buried, and not duplicating comments helps avoid that problem. If there's something slightly different, it may be worth linking to another comment in a different subthread and adding a few sentences to cover the differences. Copying a whole comment is never a good answer, and re-wording it to obscure the fact that it's not saying anything new is also bad. New comments should have something new to say.
- lukan 2y agoPosting a link of the other replay is a solution as well.
- deleted 2y ago[deleted]
- hinkley 2y agoI would get confused handling follow-ups to both copies. I have enough trouble if someone responds to my responses in a tone similar to GP and I end up treating them like the same person (eg, GP makes a jab and now I’m snarky 9r call out the wrong person). Especially if I have to step away to deal with life.
- hobobaggins 2y agoAnd, just like that, you turned the rest of this thread into a meta discussion about HN rather than about the topic. It's ironic, because that really hurt the SNR more than a duplicated, but on-topic, comment.
- immibis 2y agoThe countermeasure is to disable the loop buffer. Everyone who wants to protect themselves from the unknown vulnerability should disable the loop buffer. Once everyone's done that or had a reasonable opportunity to do that, it can be safely published.
- jdiff 2y agoThere's no real impetus except paranoia if the change is unannounced. You don't have to detail the vulnerability, just inform people that somewhere, one exists, and that this is in fact a countermeasure. Without doing that, you don't shift liability, you don't actually get people out of harm's way, you don't really benefit at all.