3 ms·
Wow. Ok so given that this is a hardware flaw and not a software flaw is this kind of disclosure reasonable? In the case of software vulnerabilities, researche
by bognition 11y ago
Wow. Ok so given that this is a hardware flaw and not a software flaw is this kind of disclosure reasonable? In the case of software vulnerabilities, researchers typically inform vendors and allow them time to distribute a patch. Is there anything analogous here for hardware? If yes how does intel (or any hardware vendor) get ahead of this by distributing a fix?
- JoeAltmaier 11y agoIf its an unfixable problem then there's an obligation to disclose. Else only the 'bad guys' know.
- bognition 11y agoBut doesn't this assume that the 'bad guys' have knowledge of the exploit. This feels like a faulty assumption. However after disclosure the bad guys will definitely have knowledge. Also after disclosure what is the right course of action? We certainly can't require the replacement of all vulnerable hardware.
- Kalium 11y agoLet's break it down for examination. Before disclosure, the bad guys may know and the good guys certainly do not know. After disclosure, both bad guys know and good guys know. Good guys who know can take protective steps. Who gains the most?
- kllrnohj 11y ago> Ok so given that this is a hardware flaw and not a software flaw is this kind of disclosure reasonable? Yes. Always, always yes. Even if it's unfixable, ignorance of there even being a problem is not better. > Is there anything analogous here for hardware? Yes, actually. BIOS updates can include microcode updates and workarounds for hardware issues. Similarly if it takes a specific pattern to happen (which this almost certainly does as that's how these things work), that's going to be trivial for everyone's antivirus scanners to catch.