10 ms·
> Are we going to prosecute all long-tail problems in any product? Hopefully yes, if it’s proven the vendor knew but released anyway or didn’t disclose.
by joenathanone 3y ago
> Are we going to prosecute all long-tail problems in any product?
Hopefully yes, if it’s proven the vendor knew but released anyway or didn’t disclose.
- imglorp 3y agoRealistically, no. Security is not a feature people are dying to pay for, it's just overhead. Look at Experian, on the front page again, still insecure. It's cheaper to make the defective product and say you're a little sorry, now and then.
- _8j50 3y agoTheir decision not to fix is not the problem, their decision to keep the flaw a secret and sell products with a performance expectation set and then release patches that slow down that paid for performance is.
- SubjectToChange 3y agomitigations=off Anyone who needs out-of-the-box performance can get it if they're willing to accept out-of-the-box security. Of course that doesn't make these side-channel attacks any less frustrating. For instance the original Meltdown and Spectre attacks were on my mind when I chose to "vote with my dollar" and buy an AMD CPU, only to end up with Zenbleed this year lol
- _8j50 3y agoThey shouldn't have to accept OOB security flaw that was not disclosed intentionally at the time of purchase. If intel just made that information public when they found out, your argument would be valid. They could have also purchased different processors.
- qchris 3y agoIsn't this sort of what the lawsuit is for, though? Even if it's cheaper to make the initial defective product and say you're sorry after, if the sorry is both guaranteed (prosecuting even the long tail) and large enough, then hopefully at some point it raises the overall cost to the point where it's now cheaper to build things correctly.
- hnfong 3y agoAre we really going to essentially outlaw releasing buggy software now? And taking down software and services once a security issue has been found? Because I don't think any software I wrote was ever 100% bug-free. And all bugs are potentially a security issue.