▲ 846 ▼ AMD denies researcher a $10,000 bug bounty after fixing critical auto-updater vulnerability — security flaw took 124 days to patch (www.tomshardware.com) submitted 4 months ago by sanitation@lemmy.today to c/technology@lemmy.world 92 comments fedilink hide all child comments
[–] Giooschi@lemmy.world -3 points 4 months ago (5 children) Do you really need signing if you're using HTTPS though? permalink fedilink source parent hideshow 5 child comments replies: [–] lemmyvore@feddit.nl 12 points 4 months ago HTTPS is privacy in transit. It has no say into what's being downloaded. permalink fedilink source parent [–] DevDave@piefed.social 6 points 4 months ago A drug dealer with a heavily armed escort delivers a package of white powder. New problem: is it cocaine, cleaning detergent, anthrax, or some mixture of the former? permalink fedilink source parent [–] tunetardis@piefed.ca 2 points 4 months ago I suppose if the only way to obtain the patch were through an automated download from the AMD website, the authentication through the site certificate would be better than nothing. But this is a security patch, and I think the researcher is right in pointing out that the bar needs to be higher? permalink fedilink source parent [–] Miaou@jlai.lu 1 point 4 months ago* Lots of downvotes but no actual answer to your question. I assume it's in case some third parties redistribute the binaries so end users can still check them? Mirrors, internal IT update mechanisms, idk permalink fedilink source parent [–] Buddahriffic@lemmy.world 1 point 4 months ago My version of questioning this is if the same source is providing both the file and the hash, does it matter how hard it is to fake the hash? It could just generate a new hash for the fake file, couldn't it? permalink fedilink source parent
[–] lemmyvore@feddit.nl 12 points 4 months ago HTTPS is privacy in transit. It has no say into what's being downloaded. permalink fedilink source parent
[–] DevDave@piefed.social 6 points 4 months ago A drug dealer with a heavily armed escort delivers a package of white powder. New problem: is it cocaine, cleaning detergent, anthrax, or some mixture of the former? permalink fedilink source parent
[–] tunetardis@piefed.ca 2 points 4 months ago I suppose if the only way to obtain the patch were through an automated download from the AMD website, the authentication through the site certificate would be better than nothing. But this is a security patch, and I think the researcher is right in pointing out that the bar needs to be higher? permalink fedilink source parent
[–] Miaou@jlai.lu 1 point 4 months ago* Lots of downvotes but no actual answer to your question. I assume it's in case some third parties redistribute the binaries so end users can still check them? Mirrors, internal IT update mechanisms, idk permalink fedilink source parent
[–] Buddahriffic@lemmy.world 1 point 4 months ago My version of questioning this is if the same source is providing both the file and the hash, does it matter how hard it is to fake the hash? It could just generate a new hash for the fake file, couldn't it? permalink fedilink source parent