Monday, January 29th 2018
US Lawmakers to Pull Up Intel, ARM, Microsoft, and Amazon for Spectre Secrecy
In the wake of reports surrounding the secrecy and selective disclosure of information related to the Meltdown and Spectre vulnerabilities leading up to the eventual January 3 public release, US lawmakers are unhappy with leading tech firms Intel, Microsoft, ARM, Apple, and Amazon. The five companies, among a few unnamed others, are being pulled up by a house committee over allegations of selective access of vital information that caught many American companies off guard on the January 3rd. Barring a few tech giants, thousands of American companies were unaware, and hence unprepared for Meltdown and Spectre until January 3, and are now spending vast resources to overhaul their IT infrastructure at breakneck pace.
In letters such as this one, addressed to CEOs of big tech firms, lawmakers criticized the secrecy and selective disclosure of information to safeguard IT infrastructure, which has left thousands of American companies out in the lurch, having to spend vast amounts of money securing their infrastructure. "While we acknowledge that critical vulnerabilities such as these create challenging trade-offs between disclosure and secrecy, as premature disclosure may give malicious actors time to exploit the vulnerabilities before mitigations are developed and deployed, we believe that this situation has shown the need for additional scrutiny regarding multi-party coordinated vulnerability disclosures," they write.
Source:
Tech Republic
In letters such as this one, addressed to CEOs of big tech firms, lawmakers criticized the secrecy and selective disclosure of information to safeguard IT infrastructure, which has left thousands of American companies out in the lurch, having to spend vast amounts of money securing their infrastructure. "While we acknowledge that critical vulnerabilities such as these create challenging trade-offs between disclosure and secrecy, as premature disclosure may give malicious actors time to exploit the vulnerabilities before mitigations are developed and deployed, we believe that this situation has shown the need for additional scrutiny regarding multi-party coordinated vulnerability disclosures," they write.
35 Comments on US Lawmakers to Pull Up Intel, ARM, Microsoft, and Amazon for Spectre Secrecy
Still, the Spectre vulnerabilities have been known for a long time. They informed some vendors back in June, which means that they would have know about them way before then.
www.amd.com/en/corporate/speculative-executionEdit: Now that I read this statement again, isn't that "optional" exactly what Linus was angry about when reviewing Intel patches?
Personally, I think that they (meaning Intel, Google, MS, Linux kernel community etc) should take a fine in the 10s to 100s of millions for keeping everyone not involved directly in the dark. Other than that, they handled things passably well on the pure engineering side.