Technology

That is essentially the behavior AMD is incentivizing here.

The updated post contains the full story, and it goes as follows: Back in February, when AMD asked Paul to bring down the blog post temporarily, the company said it would issue a standard CVE, fix the software, and attribute the findings to him, though a bounty payment was out of the question. Paul agreed (a decision he now regrets), though he asked what kind of timeline AMD would follow, suggesting the industry-standard 90-day window until he posted the public disclosure again.

AMD replied saying that it would "likely need a longer embargo, as additional tools beyond Ryzen Master appear[ed] to be impacted and [would] need releases." That was an interesting statement in several ways: first, it raises the question exactly why AMD would need so long to publish what was seemingly a one-character fix, replacing "http" with "https" in the code. Second, if the issue was bad enough to require so long to solve, then arguably Paul's work would merit some recompense. Third, as Paul pointed out, if this issue looked this pressing, why didn't it have a higher priority?

Nevertheless, he ended up agreeing on a 100-day window, and asked AMD the equivalent of "wassup?" before the clock ticked its last tock, only to be asked for extra time again, being told that "multiple tools are affected by [the bug]", and that "[AMD's] customers request additional time once [the fixes] are made available." Eventually, AMD reached out stating that a fix would be ready on June 9, totaling 124 days after the initial finding.

"the company said it would issue a standard CVE, fix the software, and attribute the findings to him, though a bounty payment was out of the question."

Nah, they should pay him...

I feel for people wanting to be security researchers with a conscience. They used to get thrown in jail or hit with lawsuits. Things progressed to where they could get a tiny fraction of the black market value as a bug bounty, and possibly even make a basic living doing that, but we are probably headed back in the other direction.

Meanwhile, black hats are sitting in a resort pool somewhere spending the half million some authoritarian regime paid them for a simmilar exploit, trying to drink enough all-inclusive booze to avoid thinking of the people getting their fingernails pried off in some goulag after getting exposed via said exploit.

Well shiiiiiiiiiit balls.

I was thinking just pay the 10k amd

How do you KNOW the CIA wasn't paying for that bug to be prolonged?

Same question about epistemology: how do you KNOW God is/isn't real? How do you know this isn't a simulation with a system administrator who can supplant causation that is capable of being proven scientifically?

You live in a police state. The CIA routinely breaks the law for purposes they deem necessary. It's a possibility they were exploiting the bug for their purposes. This is the reality we live in. But this gets dismissed by charismatic figures in the news so the average person never truly considers it. Operation Mockingbird was FIFTY years ago, proving the agency is not just lying to the American public but actively breaking the law to do so. Why not this?

Instead, report the security issues to malicios third parties who pay more than AMD.

Buy used, compensate for the loss in power with algorithmic ingenuity, yadda yadda.

Also, if you can do the thing the app does on paper, you should just do it on paper and can save the computer for more difficult tasks like the old-timers that paved the way for our modern-day laziness.

Use the public library, also.

I dunno, man. Seems like all the convenient options at this point require you to capitulate to some asshole trying to jack up prices and deny payouts, and the only option now is to take high roads that are unpaved.

Honestly? Fuck technology. I'm probably just in a bad mood, but that's how I feel right now. Get rid of all of it. If you can't figure it out on an abacus, you don't really need to know it!

Do yourself a favor and actually read the article. Not saying AMD is in the right here, but they aren't in the wrong for not paying Paul when he agreed to no pay out.

Same. Unless I live like a hermit in the woods, I am definitely using, directly or not, something (many things) made by a company that has done unforgivable shit. And even if I personally decide "to hell with all this, I can survive just fine", who will be there to stop them from destroying the whole forest I am supposedly in? Definitely not me

This does not make things all right as they stand, but it does mean quitting the game is not an option

They should ask Microsoft about those current troubles.

Either you pay bug bounties, or crypto locker ransoms.

They could have worse. The extreme geeks who worked as engineers for AMD pushed to open source their firmware, PSP, everything at one point.

Can you imagine Nightmare but with PSP or Intel ME? It would be EPYC™

And stupid

We let the psychopaths get their way

If it's in the code, it's a bug. If it's not used, then remove it entirely. Everything in the code should be treated as operational.

I guess it's one of those "justifiable but unwise" sort of things. If your company is doing a bug bounty program to stay on top of security vulnerabilities, what you don't want is to create the perception that the work of devs who look for these vulnerabilities isn't appreciated, for example, by skimping on bounties over technicalities.

Paying the 10k doesn't ruin the company and allows them to fix a section of code that may become a vulnerability in the future. Not paying the 10k saves them 10k at the price of the devs' trust that keeps this program effective. From a financial point of view, this is some very poor decision making.

Even if it was that simple, this is still a vulnerability that is basically a time bomb. The day that code would have been triggered would have been disastrous.

But this isn't new, bug bounties tend to have terms as strict as they can to deny you the bounty while they obviously end up fixing issues that don't qualify for the bounty. All because of reason X or Y that turns out to be a subjective interpretation of a vague enough eligibility requirement.

Okay, yes, but that's because they had messed up their application enough that the updater itself couldn't be updated, which they presumably discovered in the process of trying to remedy his bug. That is, the flaw he found couldn't actually be exploited only because of a deeper flaw he hadn't found. (Shades of the Sirius Cybernetics Corporation there, whose deep fundamental design flaws were almost totally hidden by their superficial design flaws.) He still led them to a critical vulnerability that took them months to fix.

AMD now with their security stuff and Intel with the crashing and quick degradation stuff a while ago. Sigh.