Hacker News new | ask | show | jobs
by develatio 981 days ago
Even if they knew, what would they do about it? It's not like "the governments" could pull up a Spectre patch out of thin air. There are no mitigations. So what do they gain from knowing if they can't avoid it anyways?
5 comments

There are mitigations for many vulnerabilities that don't involve the software being patched. For example, once you know a particular vulnerability exists, even if it's unpatched you can monitor for attempts against it, modify firewall rules and process monitoring to improve your awareness, etc.
It’s not uncommon for groups like CISA to recommend blocking things from the internet or disabling a particular feature which is part of the exploit but not critical to the entire app. They also proactively notify users in some cases (e.g. industrial systems) so everyone knows to install the patch as soon as it’s released.

As a simple analogy, look at how the Kia lock vulnerabilities are being handled. Yes, it’s best if you can repair everything but it’s not without value to make sure everyone affected knows the risk so they can change their behavior or buy a separate lock until then.

> There are no mitigations

They can use different applications and communication channels to avoid leaking data to hostile governments.

> There are no mitigations.

What about, everybody stops using the defective software? Or, more conservatively, all EU governments stop using the affected products?

> Even if they knew, what would they do about it?

Call meetings. Join endless meetings. Make deadlines for more meetings.