Intel microcode license updated to permit redistribution | Hacker News Reader

Intel microcode license updated to permit redistribution

01.org

184 pointsrnhmjoj38 comments

Can anyone with background in law in some of EU member states share their take on enforceability of the DeWitt clause[0]?

I know it popped up quite a few times here, but very few commented on it in the context of EU.

[0]: https://en.wikipedia.org/wiki/David_DeWitt

AFAIK EULA's are unenforcable in the EU.

Disclosure: IANAL

I doubt it's anywhere near that simple. The EU, being a loose confederation of independent countries that had all been doing their own things for a very long time before joining up, has a wildly heterogeneous legal environment.

Even in a single country like the US, whether a EULA will be considered enforceable depends heavily on a plethora of factors, including what court the case is being tried in.

IANAL. This is not legal advice.

AFAIK, in Germany a EULA is enforceable. But if you are only presented with the EULA after having bought the product (e.g. if the software came on DVD in a shrink-wrapped box, so you couldn't look at the EULA at the store), you're entitled to a refund if you don't agree to the EULA.

EULAs are enforceable, but surprising or unreasonably discriminatory clauses are not. When it comes to contracts with private customers, judges tend to interpret that highly restrictively.

Eula's are enforceble. However they need to adhere to some standards. For the Dutch for example;general eula aka 'algemene voorwaarden' can not be 'unfair' this is quite ubiquitous, but still you cannot suddenly put 'anything' in there. This specific case would not hold as it is not fair to the customer. (faulty hardware has been supplied and this firmware is nothing but a correction to their shortcoming) I'm sorry that I cannot give a more elaborate explanation of this. IANAL.

The problem with enterprise software, such as data management software, where this clause is most often used, is that it doesn't come with an EULA, but with a full blown contract negotiated between the software manufacturer and the client.

Such contracts can run into dozens of pages and can be very specific.

It usually contains clauses specifying precisely what the customer is allowed to do with the software and what not.

A good example would be SAP, who sued Diageo for using the software in a way, which was not licensed. A court awarded the software provider north of 50'000'000 £ for allowing indirect access to the software[1]

If you think you're better off by using Oracle I have a license to sell you, but I digress.

Since those are full blown contracts negotiated between professional entities it's a quite safe bet that they are upheld by the courts.

[1] https://www.computerworlduk.com/it-vendors/sap-indirect-acce...

A lawyer friend of mine one told me that his job was basically to try to see what he could sneak past the opposition's (his sentiment, not mine) lawyers in their contracts. He explained contracts are like a running game of tag for lawyers. "If they don't read it, fuck 'em".

He also said that all contracts are mutable. Just strike in red whatever you want, sign it, and send it back. If they don't object (for whatever reason, including not expecting a non-lawyer to do such a thing and never reading your reply), you've won this round of tag.

Then mentioning that 9/10 contract disputes get settled out of court meant the law didn't really matter, it's just what you can convince others about.

Of course, you want some ground rules but you also don't want to be such an ass of a company that you loose customers/collaborators over petty things.

In my company we have a legal department sometimes making contracts that us researchers are ashamed of (we get to use all your samples, any IP is ours when generated during the duration of the contract by the people involved, etc), and then there is our wish to keep collaborating with the other party and keep all of us working happily together now and in the future. These things collide, contracts get ignored.

That's a rules of the game. Every department want to grow its importance in the company, to get more power and resources. Well, sometimes this end up in failing company, but they have no choice - if dep X decide to stop it, other won't - and the company fail anyway, but with dep Y on the top instead, all the difference is who will have more power during some time - then the choice is clear and no department will stop their play.

> our wish to keep collaborating with the other party and keep all of us working happily together now and in the future

And typically, this is not when you need a good contract. When the relationship sours, you will be happy the lawyers did their job.

This reminded of a counter-exemplary story, A Tiny, $25 Million Mistake:

https://www.npr.org/sections/money/2014/09/16/348975479/a-ti...

> Levine had always thought a contract was binding. Now he saw two big companies laugh off his little mistake. The other side agreed to revise the contract to pay the extra $25 million.

> The whole experience surprised Levine. "I thought it was a game," he says. "You sort of score points. And they had scored this point through my fault, and they were going to get something for it."

> Business may be a game, Levine realized, but it's not a one-time game. It's more like an infinite game. It's a game in which people have to live with each other, work with each other again, and perhaps, write another big contract.

Text-only link (no ads, no tracking): https://text.npr.org/s.php?sId=348975479

There was a Russian chap that did this exactly this, modified his credit card contract and the bank happily signed the modified contract without reading it: https://www.nasdaq.com/article/updated-russian-man-turns-tab...

This is essentially how all business works. When I got my first job before I went to university I was very surprised to learn that accountants always pay invoices on the very last day of the terms rather than as soon as they can. Since everyone else is going to pay you as late as they poassibly can, if you pay your invoices as soon as you can you'll lose out in the long run.

The way everyone tries to get slightly more from other people than they give back is one of the things I dislike most about humans. I wish we had a system that punished such behaviour rather than rewarding it.

It's not hard to construct a "multi agent" version of the prisoners dilemma, in which only one prisoner defecting would cause every prisoner to defect.

Canonically, the Prisoners Dilema is a game with one round and each player has no idea what strategy the other player will employ; the one round is taken simultaneously. In this version, it doesn’t make sense to say “one prisoner defecting would cause every prisoner to defect.” That sounds more like the tit-for-tat strategy in multi round prisoners dilema.

No, it works in the simultaneous one-round case as well. I think you know what I mean, and it's frustrating when people reply glibly just to try and seem high and mighty online.

Let's say that all defecting prisoners are given a light sentence, and all non-defecting prisoners are given the full sentence. You can work through the rest.

It's often not that they're really trying to screw the vendor, but that their cash flow doesn't allow immediate payment.

A lot of commercial invoices have payment terms like "2/10, net 30" meaning you can take a 2% discount if you pay within 10 days. The cost of not taking this deal is an effective 35% annualized interest rate, so it's a big incentive to pay early, assuming your cash flow allows it.

I used to do this as a freelancer..

Some clients would insist on 45 or 60-day terms for my invoices, and as a self-employed individual (who at the time couldn't afford to be picky about my contracts), this really sucked.

Then someone suggested to me I put a clause offering a 2% discount if they paid within 15 days.

I definitely remember some of my clients taking me up on that and paying quickly, and it was a big help..

I remember the first time I discovered what “30day net” meant. “What? You’re going to borrow my money for 30days???”

I’m a consultant and I charge $N for 30 net and 25% off if payed in 10. (25% is not a typo.) Very few of my clients do the math and decide they want to borrow my money for the full month.

>> When I got my first job before I went to university I was very surprised to learn that accountants always pay invoices on the very last day of the terms rather than as soon as they can.

I was told one company I worked at held off payment beyond the terms - waiting until we owed enough to be worth their bother. The problem was that one guy was trying to order parts to build some prototypes for a customer and they refused to do anything until they got paid. Our sales efforts were being hindered by people refusing to do their jobs - i.e. pay suppliers.

The bigger news is that they've applied the license to FSP too. Great news for coreboot.

https://mail.coreboot.org/pipermail/coreboot/2018-August/087...

I had a quick Google and couldn't find any published benchmarks yet. Does anyone know of one so far?

According to a German news article [0], Intel published benchmarks themselves [1].

[0]: https://heise.de/-4144515

[1]: https://www.intel.com/content/www/us/en/architecture-and-tec...

Can anyone explain these graphs a bit. I.e the first one shows no impact what-so-ever, but are the benchmark conditions real-life-y enough?

Well, the first two aren't even interesting at all, because the fix is not needed there and it is disabled.

The first two just show, that the fix doesn't make performance worse when disabled.

"With non-virtualized operating systems."

"For non-virtualized environments or where it can be guaranteed that all virtualized guest operating systems are trusted." --> Aka disabled.

Intel's attempt to suppress independent benchmarking suggests that this is not the whole story. This suspicion lingers even though it has removed the clause.

There exists other reasons to not allow third-party benchmarking, other than trying to hide something. A common reason is as a way to make sure the benchmark is done in a proper way.

I've had the experience myself, and I can imagine that when a system is complex and hard to measure that you don't want an internet journalist running Cinebench to become the reference benchmark for your customers.

That's a fair point, though the best solution would be for Intel to commission independent or independently-audited benchmark tests.

Yeah, but what if the microcode killed cinebench performance? Wouldn't that be interesting?

The problem is still the context in which cinebench would be ran. There are so many variable on a complex system that "the microcode killed cinebench perf" could very well be an over simplification of "the microcode in conjunction with this particular motherboard and this version of the kernel plus this particular Nvidia driver lead to a bad interaction that affects cinebench performance negatively".

This is all I've seen so far.

https://www.phoronix.com/scan.php?page=article&item=l1tf-for...

While interesting, those benchmarks are only for the kernel mitigations; they don't benchmark the new microcode:

> Update: To note, no microcode changes/updates were made to the systems under test for this article, just testing/comparing the kernel patches.

Marvel Cinematic Universe?

I would watch the hell out of the Intel MCU. The story line about the Avengers getting in trouble for "speculative destruction" practically writes itself.

Just to save others the two minutes of googling I just went through, apparently the MCU in the title stands for "Microcontroller Unit" (and not "Marvel Cinematic Universe" as per my original thought).

I think 'microcode update' is what is meant here.

Reply on news.ycombinator.com