Hacker News Reader

Comment by joenathanone | Hacker News Reader

> Are we going to prosecute all long-tail problems in any product?

Hopefully yes, if it’s proven the vendor knew but released anyway or didn’t disclose.

Realistically, no. Security is not a feature people are dying to pay for, it's just overhead. Look at Experian, on the front page again, still insecure. It's cheaper to make the defective product and say you're a little sorry, now and then.

Isn't this sort of what the lawsuit is for, though? Even if it's cheaper to make the initial defective product and say you're sorry after, if the sorry is both guaranteed (prosecuting even the long tail) and large enough, then hopefully at some point it raises the overall cost to the point where it's now cheaper to build things correctly.

Are we really going to essentially outlaw releasing buggy software now? And taking down software and services once a security issue has been found? Because I don't think any software I wrote was ever 100% bug-free.

And all bugs are potentially a security issue.

We're talking about known security bugs, not just bugs. Stop with the strawman.

Just like everyone else is susceptible to lawsuits for bad services, faulty products, or ...

Their decision not to fix is not the problem, their decision to keep the flaw a secret and sell products with a performance expectation set and then release patches that slow down that paid for performance is.

    mitigations=off

Anyone who needs out-of-the-box performance can get it if they're willing to accept out-of-the-box security. Of course that doesn't make these side-channel attacks any less frustrating. For instance the original Meltdown and Spectre attacks were on my mind when I chose to "vote with my dollar" and buy an AMD CPU, only to end up with Zenbleed this year lol

They shouldn't have to accept OOB security flaw that was not disclosed intentionally at the time of purchase. If intel just made that information public when they found out, your argument would be valid. They could have also purchased different processors.

Reply on news.ycombinator.com