Hacker News new | ask | show | jobs
by cjbprime 3091 days ago
You think Intel considers AMD vulnerable while AMD considers itself not vulnerable? That's quite an assumption to ask of us.
2 comments
betterunix2 3091 days ago
It was an AMD engineer, and he referred to specific details about a microarchitecture bug that seems to be important in this attack. So we are really being asked to believe that Intel's PR team knows more about AMD's microarchitecture than AMD's engineers (or that AMD's engineers are secret PR agents).
link
tedunangst 3091 days ago
Would not be the first time vendor X knows vendor Y is vulnerable even as vendor Y denies it.
link
shock 3091 days ago
Now my interest is piqued: what instances of `vendor X` and `vendor Y` do you know of?
link
tedunangst 3091 days ago
Well, at least one time I found a bug in OpenBSD, told NetBSD, then looked at their fix and discovered our fix was incomplete because my regress had a false negative. But up until that moment I was pretty confident about our fix.

I think that's sort of a pattern. Vendor X is affected by a POC, so they fix the issue. They then develop more tests. Vendor Y concludes they are not affected, perhaps based on a false negative test, and fails to investigate further. Now X understands more about the true scope of the problem than Y and they have tests to demonstrate on Y, but Y does not.

link