Hacker News Reader

While I think the story's title could be more mature, I think that the outrage in the article is justified. Intel didn't notify any of the BSD teams of the vulnerability during and after the embargo period, leaving anyone running a BSD vulnerable for a longer period after the disclosure.

IMO, it's a good thing that this issue gets publicity... if only so that the 'lesser' open source projects don't get ignored in the future.

I might be wrong but wasn't it BSD that a few months ago released information on a critical vulnerability before the embargo was lifted?

I think it was the WPA2 handshake vulnerability.

I remember people saying that BSD would probably no longer receive information about embargoed vulnerabilities because of that.

> I might be wrong but wasn't it BSD that a few months ago released information on a critical vulnerability before the embargo was lifted?

BSD is not an operating system unless your referring to the original Berkley Unix. Are talking about FreeBSD?, OpenBSD?, NetBSD?, DragonflyBSD? Remember they are all different operating systems.

The three big BSDs aren't exactly obscure, they might not have the highest server market share compared to windows and linux but they are the next on the list and often a primary choice for a variety of companies critical infrastructure, the most commonly sighted example these days is netflix.

I think the outrage is justified.

Don't mistake this as OpenBSD's concern for all BSD's. This is just OpenBSD rant because they isolated themselves by not respecting embargoes in the past. Some ARM CPU's are also vulnerable by the way.

That's an interesting point RE OpenBSD, especially if FreeBSD and NetBSD were included (which I do not know), I suspect this was just down to plain irresponsible incompetence though.

...I've no idea what your ARM comment has to do with it though. Meltdown is Intel specific.

A relevant question however might be who coordinated the work between june 2017 and now for Meltdown mitigations? Project zero at google discovered it, but did they hand over the responsibility to Intel or decide who else to inform themselves?

Has FreedBSD/NetBSD made a statement. I know DragonFly has a patch on master.

It's an odd world where Linux is in the "big three" and the BSD counterparts are more on the fringe. It's a far cry from the early world of the 2000s.

The language of the post is incredibly incendiary -- they sound no different than some of the extremists / terrorists talking about their enemies.

At the end of the day, we are all humans and the chip designers screwed up in a big way. But this issue is so complex and obscure that it's been unknown for 20+ years.

That's not their argument, their issue is intel didn't bother informing them so they had adequate time to work on patches (you know like they did for linux and windows kernel devs).

Well, setting aside outrage, this looks like a primary source documenting a real problem for a marginal but sizable open source community (probably several--the *BSDs.)

It didn't really trigger my outrage button, and did inform me of something that had not actually crossed my mind--who got embargo information or not.

So, with a lot on HNers interested in open source, and using open source software, I see value in raising awareness that we should let these vendors know we value this. Some of us are making purchasing decisions at our companies and can steer our dollars toward good corporate citizens.

I find the outrage rather incidental to the post, regardless of even the email list author's intent in that regard.

People just don't like paying for intangible things, so the only way to pay for the internet is clickz/eyeballz. And OUTRGE! clickz/eyeballz are the cheapest and easiest.

The irony of course is that this was posted on a mailing list (so clicks are meaningless) by a developer of free software who has to spend his time working around these bugs that Intel caused. He has every right to be outraged and vent all he wants. He is actually doing the hard work while you watch kitten videos and chuckle-memes.

> I mean I get it: large corporations (1) don't necessarily have my interests at heart; (2) are not able to perfectly execute (on extremely large and complicated) products and systems.

> um. This is as radical as taking a stand that the sun sets in the west.

If all you're picking up from this is the emotional component (aka "outrage"), I think you've missed the point. The larger problem now is that Intel (in this case) consciously chose to ignore serious risks for their customers and is currently doing their best PR job to downplay the impact of those risks now that they have been exposed.

The reality is that these bugs are potentially catastrophic. But maybe we are supposed to simply accept that that is part of the risk of living in this modern world.

When large corporations make serious mistakes that are predictable and that others publicly warned about, they deserve all the criticism that comes their way.

My question is why anyone who doesn't work for the PR department of one of these corporations feels the emotional need to defend them from justly deserved criticism? They didn't include all the responsible stakeholders in their mitigation efforts, that decision put the users of those OSes at risk, and so the developers of those OSes are pissed about it.

Why is that unacceptable to you? Why do you consider that to be "wrong"?

You have a lot of good points. I think it's just as fair to say that if Intel were to foster real conversation and not just fire up the PR monster there'd be less outrage.

Bleh. It’s the right time, because everyone’s thinking it.

To be fair, you look at those CPU utilization graphs, and the optimization bonus for this sacrifice of security is notable. The benefits are real, for these computation strategies. The reality is that yet again, we must sacrifice convenience in the name of security. This is why we can’t have nice things.

Ultimately, though, your pining for dignified silence and stoicism as the one true lowest common denominator is to be unrequited. Civilization among the civilized is not always a good thing. We all know that somewhere deep within the unknown recesses of some massive social planning department, circuits are being designed to lock us in, and make us pay for stepping out of line. Keep that fact in the front of your mind. Not as a goof. Not as a pacifier or placebo.

It’s all bullshit. It’s a valid gripe. It bears repeating.

>I just wish there was just some corner of the internet where this wasn't the dominant trend and I had hoped it was here on HN

You're not going to find that, because taking the path of least intellectual and emotional resistance is just human nature. There is a positive feedback loop with outrage narratives that feeds people's ego and sense of in-group superiority, where one either feels empowered by agreement, or feels catharsis through disagreement.

The only thing HN has over Reddit in that regard is a culture that puts up the pretense ... sometimes.

> "...taking the path of least intellectual and emotional resistance is fundamental to human nature. There is a positive feedback loop..."

I agree that both of those appear to be fundamental elements of human psychology. Fortunately, we're also have the ability to counteract this, either individually via self-reflection, or more easily, through feedback from others. We can be aware of these tendencies and work to counteract them. If the community has a common goal to do so, to encourage the "better angels of our nature" as it were, we can do better together than we may find it easy to do on our own. And that doesn't have to be a pretense. It can be an explicit, earnest value.

Metafilter seems to be better about this stuff than we are here. At least, whenever I read it, the responses seem more thoughtful.

I agree, but Metafilter is extremely heavily moderated and there is a (small) cost to get privileges to comment/post. It also has a full time staff managing the community. I don't see either of those things changing on HN =/

Is outrage not the way that almost anything moves forward these days? I feel that if not for the internet (the modern version where anyone has the ability to publish something that can be seen by many, regardless of tech knowledge) that we would be utterly powerless. It’s one of the few things that causes large organizations to actually care about anything. It’s almost an obligation these days.

Outrage can move things, but irrational outrage will move things in a mindless direction, which doesn’t help anything.

“Intel sucks” except arm cpus are affected too. “Intel sucks” except there’s a network of entities involved in disclosure. “Intel sucks” except OpenBSD previously opted out of this disclosure mechanism. I don’t see how anything will move in useful direction from this. Perhaps Intel will find a way to write statements with better feelz. That’s nice, but it’s not substantive and doesn’t deal with any of the underlying issues here.

I am also increasingly desperate for an internet place to read and discuss things in good faith. When HN started to go downhill I shifted to Twitter, but Twitter is like poison.

Perhaps we can create a new place?

Could you estimate for us when "HN started to go downhill"?

I suppose it's different for everyone, but for me the discussion quality started to fade around 2013.

It's OpenBSD, what else to expect? This is the result of them not respecting embargoes. All they have left is to vent.