Hacker News Reader

Comment by hansendc | Hacker News Reader

I worked on the Meltdown mitigations, at Intel, during the embargo. I still work on Linux at Intel.

Intel told quite a few members of the Linux community about this well before late December. Some got told because they work for traditional distributions and others were contacted directly because they are community maintainers or subject matter experts.

Unfortunately, Greg was not one of those folks that was told early. It's pretty clear at this point that it would have been a lot better had he and folks like him been involved earlier. This is especially true for Greg since he plays such a crucial role in stable kernel maintenance, which is how a lot of the world consumes their kernels (including distros like Debian).

I'm glad Greg thinks "Intel has gotten better at this." I'd like to think so too.

View on HN

Shouldn't Greq and Linus be some of the very first people to be informed considering the amount of impact they both have on the entire Linux ecosystem? I find it alarming that they were not contacted immediately considering how much of the world/internet relies on Linux.

That does not address the stupid embargo on involved linux developers to speak about it to each other.

It shows that legal and marketing (PR spin) were prominent on the security decision tree rather than security minded individuals.

It's a real pity that Company caught putting PR before customers' interests so rarely causes a backlash, even when it's plain as day.

Don't hate the player, hate the game. It's how the entire economic model is setup. For a publicly traded company, stock price matters above all else. Stock goes down, people lose their jobs. PR departments' job consists of damage control and limiting the impact of bad news on the stock. I'm not aware of any company that would've done something different.

People actually admitting fault/guilt, publicly, means that heads are getting chopped off.

If you want to see companies' behavior change, we have to change our entire model on what "economic performance" means, and whether it's even something worth pursuing above all else.

I don't think that's really it.

Some misbehaviours result in PR disasters, but for whatever reason, no-one ever calls-out a company specifically for putting PR over customers' interests.

Disclaimer: I work on Linux at Intel.

FWIW, I don't think PR had anything to do with this. Without arguing the merits of embargoes, the goal of them is to give the good guys a head start before the bad guys. But, if you tell too many good guys, the assumption is that the bad guys find out. So, you try to tell as few good guys as possible.

This was (from my blatantly biased perspective) an honest, but imperfect attempt at keeping the bad guys from finding out. A lot of lessons have been learned since this, and the group of good guys involved in recent issues has been much more comprehensive than with the original Spectre/Meltdown bits. I think Greg was alluding to this when he said "Intel has gotten better at this."

The part that I find amazing about this is that Greg and Linus weren't at the top of the list of people contacted to ask 'this is a very sensitive issue and we'd like to work with you to figure out who we need to get involved in this' from a Linux standpoint. Intel has had people working on Linux support for many years now so it's not like they didn't have people on the payroll who knew the landscape and couldn't readily figure out who to contact. This reeks of incompetence at the senior management levels of Intel.

Greg and Linus are also some of the most visible participants, and as far as I understand, neither is considered particularly expert in the platform intricacies that would be involved in mitigating something like Spectre. Disclosing vulns to high-profile targets is a risky practice; their activity, both public and private, attracts a lot of attention. It makes sense to avoid that risk if possible.

Disclaimer: I work on Linux at Intel.

I'm biased, of course. But, I think things are much better now. We have ways of having relatively "normal" conversations about these things where a broad set of community folks are involved. It's not perfect, but it's way better than it was a year ago.

The embargo was really painful to work with, even for folks like myself who were inside Intel during the whole thing. I'm used to being able to ask folks for help and to lean on the incredible knowledge of the kernel community. For Meltdown, I was much more on my own than I was comfortable with. It wasn't fun.

> Unfortunately, Greg was not one of those folks that was told early.

Why wasn't he one of the first persons informed by Intel?

Disclaimer: I work on Linux at Intel.

I'll give you an engineer's perspective, and specifically about Meltdown since that's what I worked on.

I posted the first Meltdown mitigations in late October, publicly claiming to mitigate a less dangerous class of side-channel (https://lkml.org/lkml/2017/10/31/884). I figured that Linus would merge it (Linus knew the real reason by that point) and would "wink" at Greg and the other stable maintainers enough to get them to merge it too. At this point, we had months before the embargo ended.

In retrospect, that was a kinda silly assumption, but I was heads down trying to get the patch to work and didn't dwell on it much. I wish I would have made more noise about it, especially as we got closer to the embargo ending.

Reply on news.ycombinator.com