Comment on AMD won't patch all chips affected by severe data theft vulnerability — Ryzen 3000, 2000, and 1000 will not get patched for 'Sinkclose'

• victorz@lemmy.world ⁨2⁩ ⁨months⁩ ago

  That’s not what I was referring to. I was referring to the act of “adding vulnerabilities”. Surely they aren’t doing that on purpose. And surely they would add fixes for it if it was economically viable? It’s a matter of goodwill and reputation, right?

  I don’t know, I just don’t think it’s AMD’s business model to “screw over” their customers. I just don’t.

  source

  • narc0tic_bird@lemm.ee ⁨2⁩ ⁨months⁩ ago

    What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).

    I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!

    I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.

    source

    • Jakeroxs@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

      Maybe they’ll reverse course with enough blowback, they did that once with ryzen already, don’t remember which Gen it was but it wasn’t going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.

      Similarish situation could happen here, the biggest hangup I’d think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.

      source
    • victorz@lemmy.world ⁨2⁩ ⁨months⁩ ago

      Well, you feel how you feel, and you choose the products you want after this. Good luck to you! 👍

      source
  • Grippler@feddit.dk ⁨2⁩ ⁨months⁩ ago

    No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It’s not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don’t want to fix even though they absolutely could.

    source

    • victorz@lemmy.world ⁨2⁩ ⁨months⁩ ago

      I’m guessing it’s a balance between old products, effort, severity, etc. As we’ve learned, this is only an issue for an already infected system. 🤷‍♂️

      source

      • Grippler@feddit.dk ⁨2⁩ ⁨months⁩ ago

        Ryzen 3000 CPU are still sold as new, I even bought one six months ago, they’re no where near being classified as “old”. And this is not an only an issue for already infected systems because uninfected systems will intentionally be left vulnerable.

        source

        • -> View More Comments
  • ShortN0te@lemmy.ml ⁨2⁩ ⁨months⁩ ago

    No, but those vulnerabilities where there when you bought it.

    Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

    Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.

    source

    • victorz@lemmy.world ⁨2⁩ ⁨months⁩ ago

      Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

      I mean… A car is different, depending on the defect. It’s like “this window only breaks if you’ve already crashed the car”. (The defect only causes a vulnerability if the system is already compromised AFAICT.) And 5 years is much, much younger for a car compared to a CPU, but that’s not the important bit, I know.

      But I agree with you all, I am not saying it shouldn’t be fixed, I was just saying I don’t think AMD is looking to screw over their customers on purpose. That’s all.

      source

      • princessnorah@lemmy.blahaj.zone ⁨2⁩ ⁨months⁩ ago

        “this window only breaks if you’ve already crashed the car”

        No, it’s usually more like “this thing will break and cause a car crash” or “this thing will murder everyone in the vehicle if you crash”. And companies still will not fix it. Look at the Ford Pinto, executives very literally wrote off people’s deaths as a cost of doing business, when they’d turn into fireballs during even low speed rear-end collisions. Potentially burning down the car that hit them too.

        source

        • -> View More Comments
  • conciselyverbose@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

    The cost isn’t that high. They’re already doing it for a bunch of parallel systems.

    In a just world they’d be legally required to provide the fixes, or fully refund the entire platform cost. It’s not remotely ethical to allow this to exist unpatched anywhere, regardless of support life.

    source

    • victorz@lemmy.world ⁨2⁩ ⁨months⁩ ago

      I agree. 👌

      source