Quis renovatores renovat — who updates the updater?

top 23 comments

sorted by: hot top controversial new old
[–] 93 points 5 months ago*

Sounds like everyone should stop reporting vulnerabilities and start selling them 🤷‍♂️ great work, AMD, there's absolutely no way this relatively small "cost saving" backfires!

  • source
  • [–] 68 points 5 months ago (5 children)

    Uhh wont that discourage zero day reports?

  • source
  • hideshow 5 child comments
  • [–] 78 points 5 months ago (1 child)

    Worse. It encourages selling them to the black market instead.

    The illicit market for newly discovered security vulnerabilities generally pays pretty well, especially if you can demonstrate implementation. The only reason it's not a much bigger problem is that most security researchers have some moral compunctions and the professional desire to fix problems, not proliferate them.

    If the companies basically tell the security researchers to pound sand, that encourages making a living elsewhere.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 4 months ago

    This is why the ISS exists BTW. It was a jobs program for ex-soviet rocket scientists since by definition they're all weapons specialists who just happen to be launching satellites instead of nukes.

  • source
  • parent
  • [+] -7 points 5 months ago (2 children)

    These days there's so much slop in the world that 0day reports end up being worthless. The idea is sound, but far too many people are abusing the system and so they're not worth having anymore.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 5 months ago

    The report is only because there's a 0-day sploit. It's not like some cogsucker can make it up and get paid.

    Okay so we'll have to have a neutral third-party confirm them, but really that will have to happen now anyway since no one will trust AMD to pay their promises.

  • source
  • parent
  • [–] 96 points 5 months ago (2 children)

    Haha, oh boy, between AMD and MS, I predict some zero-days in the near future from people like Paul (the researcher here) just selling the exploit.

  • source
  • hideshow 2 child comments
  • [–] 67 points 5 months ago (1 child)

    As they should, it's the only reasonable response to how these companies act.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 4 months ago

    The whole fragile construct of ethical disclosure sits on people/companies aknowledging it, playing along and not intentionally fucking it up. It is a cherished grape of vine that demonstrates - healthy tendencies do exist in our societies, we can sometimes communicate with each other and pursue a common good in spite of our destructive urges. Refusing to give a symbolical prize incomparable to the cost they could save, AMD and others mishandle the thing they treat as a given while completely unprepared to the state where it's gone, just like a teenager thinking they'd top the game and lose virginity when/if zombie apocalypse happens.

  • source
  • parent
  • [–] 39 points 5 months ago

    He would have got a lot more than $10,000 on the dark web.

  • source
  • [–] 24 points 5 months ago (5 children)

    That's sad. I wish AMD would not have done that 😔

  • source
  • hideshow 5 child comments
  • [–] 17 points 5 months ago (3 children)

    AMD also donated to the orange pedo, coz it's good for business.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 4 months ago (1 child)

    AMD also donated to the orange pedo, coz it’s good for business.

    Care to provide a source, please? And does anyone know if Nvidia did so too? I'm planning to switch to AMD from Nvidia, but if they're both equally lack virtue… shrugs.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 21 points 5 months ago*

    I expect 10k is nothing compared to one of their salaries. I would expect zero days are worth at least an entire salary.

  • source
  • [–] 11 points 5 months ago

    Sounds like AMD needs to be Nightmare Eclipsed.

  • source
  • [–] 11 points 5 months ago (2 children)

    Does anyone see the overlap of Mythos and Silicon Valley tech companies dodging paying for bug bounties?

  • source
  • hideshow 2 child comments
  • [–] [S] 7 points 4 months ago (1 child)

    It's more in a sense that they have been buried with slop of their own creation so they are refusing to payout anyone. Mythos was good PR move for an IPO, but an useless tool in practice. It generated thousands of tickets for smallest non-issues that dev teams have to deal with, but it couldn't even offer actual patches... Security researchers are calling it a great PR scam and I have to agree.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 4 months ago*

    People often ignore the fact that the Silicon Valley Barons have swallowed their own sauce. Silicon Valley has an industry of sycophancy to uphold their narcicism. That means they can also suffer under narcicistic delusion.

    Case in point: when Windows 8/10 was released, Microsoft - referred to as Microslop - fired all their QA teams because they believed automated QA testing was just as good. If you wonder why Windows has been so enshitified, there's the real reason. Now they have a refactoring project for Windows that uses SteamOS as a benchmark, because they know they've fucked up.

    And of course, the same can be said for the mass firing of developers because they were going to be replaced with AI, only to be hired back to then babysit that AI.

    Never forget that narcicists wear the jogging suit and drink deeply from the punch bowl, and they want us all to swallow it with them.

  • source
  • parent
  • [–] 7 points 5 months ago

    So what you're saying is they don't want anyone to fix bugs. Got it.

  • source
  • 92 comments in c/technology@lemmy.world view that post