Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.

  • Victor@lemmy.world
    link
    fedilink
    English
    arrow-up
    15
    arrow-down
    27
    ·
    4 months ago

    That’s not what I was referring to. I was referring to the act of “adding vulnerabilities”. Surely they aren’t doing that on purpose. And surely they would add fixes for it if it was economically viable? It’s a matter of goodwill and reputation, right?

    I don’t know, I just don’t think it’s AMD’s business model to “screw over” their customers. I just don’t.

    • narc0tic_bird@lemm.ee
      link
      fedilink
      English
      arrow-up
      25
      ·
      4 months ago

      What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).

      I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!

      I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.

      • Jakeroxs@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        4 months ago

        Maybe they’ll reverse course with enough blowback, they did that once with ryzen already, don’t remember which Gen it was but it wasn’t going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.

        Similarish situation could happen here, the biggest hangup I’d think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.

      • Victor@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        30
        ·
        edit-2
        4 months ago

        Well, you feel how you feel, and you choose the products you want after this. Good luck to you! 👍

        Edit: So many down votes for wishing someone good luck. The hive mind is odd sometimes.

    • Grippler@feddit.dk
      link
      fedilink
      English
      arrow-up
      16
      arrow-down
      1
      ·
      4 months ago

      No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It’s not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don’t want to fix even though they absolutely could.

      • Victor@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        13
        ·
        4 months ago

        I’m guessing it’s a balance between old products, effort, severity, etc. As we’ve learned, this is only an issue for an already infected system. 🤷‍♂️

        • Grippler@feddit.dk
          link
          fedilink
          English
          arrow-up
          7
          ·
          edit-2
          4 months ago

          Ryzen 3000 series CPUs are still sold as new, I even bought one six months ago, they’re no where near being classified as “old”, they’re hardly 5 years old. And this is not only an issue for already infected systems because uninfected systems will intentionally be left vulnerable.

          • Auli@lemmy.ca
            link
            fedilink
            English
            arrow-up
            1
            ·
            4 months ago

            Just because a store is still selling their stock doesn’t mean AND is still making them and selling them.

          • Victor@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            7
            ·
            4 months ago

            Ryzen 3000 series CPUs are still sold as new

            Ah, that changes things. Not great. But still,

            uninfected systems will intentionally be left vulnerable

            what I meant was that apparently only compromised systems are vulnerable to this defect.

            • Grippler@feddit.dk
              link
              fedilink
              English
              arrow-up
              5
              ·
              4 months ago

              what I meant was that apparently only compromised systems are vulnerable to this defect.

              That is not correct. Any system where this vulnerability is not patched out by AMD (which is all of gen 1, 2 and 3 CPUs) is left permanently vulnerable, regardless of whether or not they already are compromised. So if your PC is compromised in a few months for some reason, instead of being able to recover with a reinstall of your OS, your HW is now permanently compromised and would need to be thrown out…just because AMD didn’t want to patch this.

              • Victor@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                2
                ·
                edit-2
                4 months ago

                What I meant was exactly that, which you corroborated as correct. You’d first have to already compromise these systems, in order to be able to exploit this vulnerability. That’s as I understood it. It’s that correct?

                Gosh, it’s not easy getting my point across here today, I’m sorry.

                All I’m saying is that I don’t think AMD is doing this to us, on purpose. I think it’s just happened, and they’re not handling it very well, even though it’s somewhat understandable. At least to me. 🤷‍♂️

                But then again, I have no reason to be attacked or have my system compromised, so my situation is better than others’, perhaps.

                • Grippler@feddit.dk
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  4 months ago

                  I think what most people disagree with, is that the active choice from AMD to not fix a very fixable issue, is a choice they know leaves customers is a seriously bad position. This is something they choose to do to their customers, because they could just as well choose to help them.

                  • Victor@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    4 months ago

                    they could just as well choose to help them.

                    I think that’s what I have a hard time believing. If they could “just as well” help, it is my belief that they also would. Because I don’t think they’re morons. I think they know this hurts their reputation. There has to be some obstacle, be it financial or lack of man power or… something. That is my belief.

                    Don’t you (all) think that sounds more likely than them just leaving their customers in the dark for no other reason than not having to do work?

    • ShortN0te@lemmy.ml
      link
      fedilink
      English
      arrow-up
      14
      ·
      4 months ago

      No, but those vulnerabilities where there when you bought it.

      Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

      Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.

      • Victor@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        8
        ·
        4 months ago

        Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

        I mean… A car is different, depending on the defect. It’s like “this window only breaks if you’ve already crashed the car”. (The defect only causes a vulnerability if the system is already compromised AFAICT.) And 5 years is much, much younger for a car compared to a CPU, but that’s not the important bit, I know.

        But I agree with you all, I am not saying it shouldn’t be fixed, I was just saying I don’t think AMD is looking to screw over their customers on purpose. That’s all.

        • Norah - She/They@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          edit-2
          4 months ago

          “this window only breaks if you’ve already crashed the car”

          No, it’s usually more like “this thing will break and cause a car crash” or “this thing will murder everyone in the vehicle if you crash”. And companies still will not fix it. Look at the Ford Pinto, executives very literally wrote off people’s deaths as a cost of doing business, when they’d turn into fireballs during even low speed rear-end collisions. Potentially burning down the car that hit them too.

          Edit: I mean, just look at the Takata airbag recall. 100 million airbags from 20 different carmakers recalled because they wouldn’t activate during a crash.

          • Victor@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            2
            ·
            edit-2
            4 months ago

            When I said “It’s like”, I meant it as a simile to what’s going on with AMD right now. Not with what’s actually going on with car companies. Car companies are a whole different topic and discussion, of which I know nothing.

            • Norah - She/They@lemmy.blahaj.zone
              link
              fedilink
              English
              arrow-up
              1
              ·
              4 months ago

              Sorry, I reread it and I understand now that you were referencing the AMD chip in a comparison. I guess I still would compare it most to the Takata airbag situation. You’re right that nothing happens on it’s own, but once you’ve “crashed the car” then it kind of is a lot like an airbag not going off. It infects your computer on a hardware level, and any future OS running off that motherboard is potentially vulnerable in a way that’s impossible to tell.

              • Victor@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                edit-2
                4 months ago

                But the airbag situation is different. The airbag vulnerability is something broken which already doesn’t work on the car. It’s broken before and after the crash.

                But as I understood it, this vulnerability is only exploitable after the system has been compromised in some other way, first. So your system would have to first be compromised, then this vulnerability is exploitable. That’s like saying “your car radio will not function in this car, but only after the engine breaks.” It’s like 🤷‍♂️ OK, seems reasonable.

                But the really bad thing IMO is that this vulnerability can cause permanent damage once exploited (?). That is super, super bad.

                • Norah - She/They@lemmy.blahaj.zone
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  4 months ago

                  Except that doesn’t at all explain the wider recall of 100 million units. Not every single one of those airbags were faulty. First of all, how could we know? Testing an airbag is a potentially dangerous thing to do, let alone on an enormous scale that would require under-qualified persons to run the tests. Secondly, it’s not a 100% failure rate. If it were, it would have been picked up far sooner than it would take to sell 100 million units. If it happened just as severely no matter the unit’s age, it would have been picked up during crash-testing. What actually happened was an analysis of statistical averages that showed a far higher rate of failure than there should have been.

                  The similarities to me come from a comparison to Schrödinger’s cat. In the airbag example, you don’t know if the unit in front of you is going yo fail until you “open the box” by crashing. With the AMD vulnerability, you don’t know if ur motherboard has been infected by any virus/worm/etc until a “crash” or other signs of suspicious behaviour.

                  In both cases, the solution to the vulnerability removes that uncertainty, allowing you to use the product to it’s original full extent.

                  Look at it this way, imagine if this vulnerability existed in the ECU/BCU of a self-driving capable car. At any point someone could bury a piece of code so deeply you can’t ever be sure it’s gone. Would you want to drive that car?

                  • Victor@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    4 months ago

                    I think we’re talking past each other here. Missing each other’s points. I’m definitely confused by yours, and I feel like I’m not getting across to you. So I think I’ll say thank you for the discussion, and I’m sorry.

                    Just know this: I’m on board with everyone saying it would be good if AMD patched this for everyone. 🙂

    • conciselyverbose@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      12
      ·
      4 months ago

      The cost isn’t that high. They’re already doing it for a bunch of parallel systems.

      In a just world they’d be legally required to provide the fixes, or fully refund the entire platform cost. It’s not remotely ethical to allow this to exist unpatched anywhere, regardless of support life.