[forgotpw2018]

I deleted that because I thought it was too flamey after reading it again, but yeah refunding everyone is unrealistic.

Maybe just average out the performance impact across large cloud providers and offer that as a percentage? It probably wouldn't be hard for a company like Google to crunch metrics before/after the update and give a number for how much their performance has been affected

[mistercow]

Yeah, I think it's clear that some amount of risk has to be absorbed by the public. It sucks, but it's in our best interest to keep pushing computing forward. And we should keep in mind that it's also not like these attacks are obvious. They took security researchers four years to find.

I think the important thing here is precedent, rather than making customers whole. The question then is what, if anything, could Intel have done to anticipate and prevent this, and how do we incentivize them to take those measures in the future?

It's also possible that there's nothing to change here. There's always going to be some risk, and trying to force that risk closer and closer to zero will at some point not be worth the tradeoff. As bad as this is, if the caution necessary to prevent it would have resulted in processors being half as fast as they are today anyway, there wouldn't be any point.