Hacker News Reader

Comment by phkahler | Hacker News Reader

The US government is not a PC maker. The goal of the disclosure was to help companies figure out how to patch systems. Why would anyone expect the government to be notified first?

View on HN

The US Government has national defense responsibilities. Providing such exploit information to Chinese companies, many with strong ties to the PLA and other government organs, without notifying your own government first, seems irresponsible.

If it was beneficial from a commercial point of view to first disclose to partners outside of the US this makes sense. Intel doesn't exist to serve US national defense responsibilities; they exist to make money.

Any government has national defense responsabilities. With your logic, Intel is a multinational company and should have informed them all, which leads to its own kind of problems.

Edit: The only reasonable path seems to inform every government simultaneously, at the same time as the public. How could the EU possibly let Intel sell CPUs, and let Intel inform other governments of vulnerabilities first? So that the other governments have a time window to play with the vulnerability against the EU?

Only if you think there is some sort of moral equivalence between the governments.

There is a practical equivalence between governments. If one government could make the case that they should be informed, then any government who bought systems with "Intel Inside" could make the same argument. If you want to split governments into groups based on some notion of morality then you may want to question why a company would be allowed to do business with a country on the wrong side of that morality in the first place. That's actually a discussion I'd like to see.

Practically speaking, providing an exploit to the Russian government vs the US government - that would be a different effect, no? How would you justify providing the exploit to the North Koreans, or the Iranians?

There is a very practical morality at play here. The Chinese government runs protesters over with tanks, imprisons people without cause, attacks their neighbors without cause, etc. Would it be a good thing to aid such a government?

Putting all governments on the same moral plane is counterproductive and nonsensical. Not providing important information to your own government so that they can secure the very systems that protect you - that doesn't seem very practical.

> The Chinese government runs protesters over with tanks, imprisons people without cause, attacks their neighbors without cause, etc.

Oh come on, you're making it too easy!

Is there not?

It's not about moral its about sales, if Intel were to start to tell the US gov directly about security loopholes in products they were still selling to other nations those nations would blacklist intel for life.

Just as the US would blacklist intel if they told another nation directly first. (this is even true if they told allied nations) we have seen that just being allies does not stop the US spying (and I'm sure does not stop the opposite as well just turns out the others might be better at keeping things hush hush)

I guess people were expecting them to have a higher level of loyalty to their home country.

That gives China a strong case to distrust Intel and use their own chips. It is not like they are not already doing that, but I guess Intel might not really want to add momentum to this process.

Most likely the NSA already knew, wouldn't they?

Because they aren't omniscient, and the signal to noise ratio is very low when considering the total amount of data they can montor.

I firmly believe that, if the NSA, CIA, and possibly the FBI found out about this exploit, and found out there would be a window of several months to exploit it, then these agencies would be a danger to the safety and security of the American people.

Therefore the patriotic and responsible thing would be to help vendors patch their stuff before directly disclosing the bug to any party that would be likely to abuse the exploit.

The NSA doesn't play ball and responsibly disclose exploits to vendors immediately after discovering and profiling them, expressly because they want to use the exploits, so why should vendors be obligated to do the reverse?

Notifying the government early would only serve towards helping the government temporarily exploit this vulnerability for intelligence purposes. It wouldn't make sense to notify them until progress was made with mitigations.

Is this a joke? Why would you not expect such a major American company to notify their government, when the government is one of their biggest customers?

Intel notified vendors, (such as MS), so I'd assume the U.S. government would get these patches as well, I would also guess that any large customers of intel, (including the Gov), got some level of advanced notice, just probably not before any other large customers, which I do not see a problem with.

Who says they didnt?

Any such notification to agencies that matter would be classified information.

Now given that it’s Intel, the notification may have been “Reminder that our chips are working according to spec”, but I’m sure people knew.

intel want to be able to operate all around the world and not be forbidden form non US markets if it is seen that they directly pass an exploit to the US gov so that US gov can use it to exploit into other nations systems then those other nations will ban Intel from sales. (even US allies would ban intel)

Agreed completely, this is basically clickbait meant to stir up anti-China sentiment

They're a pretty big customer for Intel?

So?

As a customer and not an OEM, what would they do with this information other than ask other parties to hurry with updates?

The mitigations required OEMs to send firmware, microcode, and software updates.

> As a customer and not an OEM, what would they do with this information other than ask other parties to hurry with updates?

They could shut down machines for which it is an excessive risk; though honestly I don't think they should be privileged as customers go.

In some systems the PC maker controls the update path and not the operating system. As such it was important to get PC makers on the Team, otherwise users would have been left undefended.

OEM doesn't mean operating system, it means original equipment manufacturer (e.g. PC maker). You seem to have misread my comment.

In the same way people are customers of Freescale or Infineon because they buy cars? I hesitate to use the car analogy because there are recalls, but you still take the vehicle to the company you bought it from, not the supplier of that faulty part.

Not only that, Intel produces most of its chips in the US. The one plant they have in China used older processes, had to be approved by the US government and should have been repurposed to make memory chips. If you sense a pattern...

They’re a customer and a very big one. They also need to figure out how to patch their systems. Systems which may be controlling weapons.

It's eminently convenient for China to gather valuable intelligence from countries around the world.

No matter who is manufacturing what, it's Intels responsibility to ensure all those who _use_ their chips know of it immediately.

National security?

Intel is a multinational corporation.

A multinational American company

With the majority of sales outside the U.S. Are you arguing for Intel to employ some sort of "American exceptionalism" type policy when notifying customers of weaknesses? Apart from being a discriminatory position in itself, it is also not a very sound business decision.

Also, with all we know about the NSA, I'll be very surprised if the U.S. government didn't already knew and if they did, didn't try to take advantage of it.

Yes, it's headquartered in USA, all the executives are personally liable to USA laws (and not Chinese laws), and it actually is quite possible that they could be required to pursue American exceptionalism in regards to security issues, even if they weren't doing so yesterday.

I.e. an order (with due legal process) by USA government to not disclose that vulnerability to any Chinese companies would be possible and binding, but not the other way around. That's what being a USA company means, no matter where your sales are.

> an order (with due legal process) by USA government to not disclose that vulnerability to any Chinese companies would be possible and binding

In that case, sure, but I was talking about a voluntary disclosure, which is the case here.

Any country where Intel sales CPUs could require by national law Intel, AMD etc to notify its government of vulnerabilities, no later than other governments.

If Intel explicitly does some kind of US exceptionalism explicitly, the EU, China and other governments will probably require to be aware of the vulnerabilities no later than other governments.

How could the EU possibly let Intel sell CPUs, and let Intel inform other governments of vulnerabilities first? So that the other governments have a time window to play with the vulnerability against the EU?

the relevant agency would learn the same way the relevant chinese agency learned that information... right?

If they didn't discover the exploit sooner.

Who do you think the Chinese companies told upon learning about the flaws?

Their state security bureau. Chinese companies are inextricably linked to the Party.

This place is becoming more and more like reddit...

Reply on news.ycombinator.com