Should owners of processors affected by security problems receive compensation?

[W1zzard]

With all the Meltdown & Spectre drama slowly clearing up, what should processor companies do that sold you such a processor?

 

[Liviu Cojocaru]

Mmm, difficult to say...a discount would be nice but as long as the fix is provided and the impact on performance is barely noticeable I think the 6th option.

 

[Frick]

Yes, but only if applied to whomever sold it to me.

 

[R0H1T]

Interesting 35% are fine with a performance loss, sometimes a huge hit, I wonder if they'd let VW (or Toyota) get away with more pollutants & less mpg

Just to be clear the poll is brand agnostic!

 

[suraswami]

Tech world is always evolving, these things happen, so I am fine with patching the system as long as it doesn't make my system crawl and force for a new CPU upgrade.

But one thing I would do is rip off that CEO of Intel.

 

[EarthDog]

Id vote, but need to go to the front page... better integration plz....


Anyway, the last one.

 

[jsfitz54]

With all the Meltdown & Spectre drama slowly clearing up, what should processor companies do that sold you such a processor?

The question is hard to answer as some own multiple CPUs of different generations. How far back? If I vote for a discount of a future generation CPU, can I bundle discounts for the many CPUs I own towards 1 new chip?

It would seem that a flat rate cash return would be simpler to administrate.
I also like the idea of free replacements.
The Bios patches right now don't appear to extend past the Z170 era chipset, so how is that covered?

More questions than answers right now.
I do think some sort of compensation should be given but could this bankrupt Intel if the flaw is 20 years old?

 

[droopyRO]

I`m still waiting for my GTX 970 3.5GB compensation.

 

[lexluthermiester]

My vote was " Not as long as fixes are provided ". That is conditional on the "fix" being easily applied.

I'm still waiting for my GTX 970 3.5GB compensation.

I'm not. Got a replacement card and a partial refund. But that situation isn't the same as the whole Meltdown & Spectre problem. NVidia deliberately released a product making a claim of certain specs without fully disclosing that there were problems that would be encountered. What they should have done was release the card with only 3.5GB of VRAM at 224bits. Would have been just fine. But the MLTDN&SPCTR problems are not a disclosure, design, defect problem. They are an unforeseen vulnerability in the way CPU's function normally, one that has existed since the 90's.

 

[FordGT90Concept]

There should only be compensation if there was negligence. In this case, I think that claim can only be made for Cannonlake. Intel is going to get sued for that one by enterprise customers. They knew about the flaw and didn't warn the customers that will be effected by it. I don't know what the legal system will decide by it's going to cost Intel a hefty chunk.

 

[hat]

I voted for discount on new CPUs, hopefully which would have a baked in hardware fix that doesn't degrade performance and comes with the usual generational improvements. I'm thinking of what I would want to see if I were somebody who runs a server farm, as those are the most affected.

 

[lexluthermiester]

They knew about the flaw and didn't warn the customers that will be effected by it.

Seriously, it's not a "flaw". It's a vulnerability. There's a difference. And they did give out a bulletin that a new vulnerability had been found, that they were working the problem and would release details after more research and fixes had be developed. Which is exactly what they did.

 

[FordGT90Concept]

They did not disclose that the fix would drastically reduce mainframe performance yet they knew it judging by the CEO selling all the stocks he legally could. Had purchasers of Cannonlake enterprise processors known that, they would have withheld their purchase. Intel is going to have to make the uphill climb proving that they didn't know that significant performance penalties were not known at the time.

It's a "flaw" (especially the performance ruining aspect) when a vulnerability is known and they launch it anyway. It would be like if a car manufacturer purposefully installed defective Takata airbags in a vehicle. Like defective airbags, I think Intel has a responsibility to fix these systems. Those who they basically defrauded, they should start a recall program and anyone who chooses to participate do not forfeit their right to sue. It's going to cost the companies that were defrauded a fortune to pull all the defective chips, return them, and install the new ones. They deserve compensation on top of that.

Consumers (Cannonlake) that are largely unaffected by the performance reducing aspects of the chips should be able to opt-in to the recall program as well but through the system manufacturer. The shipping, labor, etc. costs are on the consumer though.


I don't think Intel can be faulted for processors sold before the vulnerability was known to Intel. I can't think of any grounds for that case.

 

[lexluthermiester]

It would be like if a car manufacturer purposefully installed defective Takata airbags in a vehicle.

Sorry, it's not at all like that. An airbag with a defect is a manufacturing problem. None of the CPU's affected by Meltdown or Spectre are defective. They function perfectly within the parameters and specifications of their design. However, that design can be manipulated maliciously in ways that the designers never envisioned, therefore, not flaw or defect. Simple vulnerability. And whether they knew about it or not is irrelevant, it is not libelous as the vulnerability was not intentional on any level. This applies equally to every maker of CPU's not just Intel. The legal nonsense being generated but all of this is without merit and should be laughed out of court. Now don't for a second think I'm being an Intel fanboy. I'm absolutely livid about the ME/AMT thing. That kind of BS is a train-wreck waiting to happen, the existence of which is completely intolerable.

 

[CAPSLOCKSTUCK]

GTAV used 65 % of my CPU before the fix.....now it uses 58 %


Long live socket 1366.......

 

[FordGT90Concept]

None of the CPU's affected by Meltdown or Spectre are defective.

It's like effectively losing 2-3 cores of an 8-core processor. I'd call that defective, especially when electing not to take that performance hit results in vulnerable virtual machines. Sure, people aren't dying from it like Takata's defective airbags but as far as a defect in processors go, it doesn't get much worse.

 

[Flaky]

Last one.

Sad to see that not even a fraction of that shitstorm happens in regard to smartphones, which often never get patched, and stay vulnerable forever.

 

[lexluthermiester]

It's like effectively losing 2-3 cores of an 8-core processor.

Where are you getting those numbers? That's a gross over-exaggeration of the effect the patches have on performance...

I'd call that defective

It's a software patch that causes the effect on performance, not a problem with the hardware itself. Not a defect/flaw. A vulnerability.

Sad to see that not even a fraction of that shitstorm happens in regard to smartphones, which often never get patched, and stay vulnerable forever.

While all CPU's are affected by Spectre, not all are affected equally. Taking advantage of Spectre on ARM CPU's, while possible, is a few leaps more difficult and is not as serious a problem. Given that Android already has a few precautions in place to protect it, patching Android is not as imperative. However, Google is still working the problem as some variables need to be worked out.

 

[john_]

Intel sold so many processors those last years, that it would totally destroy them any meaningful compensation. Considering that AMD can't support the whole planet with Ryzen processors, neither ARM architecture can replace x86 in one night, the only option probably is a discount to anyone who can prove that is still using an affected by Meltdown Intel CPU today. And that discount should be valid also for everyone buying an Intel 9000 tomorrow, because even that processor would be probably affected. If it is not, then either Intel enginnears are magicians, or all these security problems with Intel processors lately, are not a coincidence.

Spectre affects everyone so, I don't know if companies should compensate their customers because of it. Most doors in the market can be opened by thieves, even when they are advertised as secure doors. We never seek for compensations for something that affects all products in a certain category. We just accept it as it is.

 

[FordGT90Concept]

Where are you getting those numbers? That's a gross over-exaggeration of the effect the patches have on performance...

It was from a study done last year I believe. Microsoft hasn't finished their performance analysis on Windows Server as of January 9 and I don't think there have been any updates since.

It's a software patch that causes the effect on performance, not a problem with the hardware itself. Not a defect/flaw. A vulnerability.

It's a software patch compensating for a hardware vulnerability. If I'm understanding it correctly, the worst of the problems stem from hardware virtualization implementations not being as isolated as they should be. Future generations of processors will likely have it fixed but it's obviously too late for a hardware fix for chips already in the wild. Think of Samsung's exploding batteries in their phones. Problem was a hardware issue and they used software to warn and attempted to mitigate it then finally forbidding charging the device forcing users to submit their devices to recall. Software is a short term fix to a long term hardware problem.

While all CPU's are affected by Spectre, not all are affected equally. Taking advantage of Spectre on ARM CPU's, while possible, is a few leaps more difficult and is not as serious a problem. Given that Android already has a few precautions in place to protect it, patching Android is not as imperative. However, Google is still working the problem as some variables need to be worked out.

Very few mainframes run on ARM. Mainframes running dozens of virtual machines for internet content (especially the compute variety) are the most vulnerable. If one VM gets infected, it could expose customer data from all the VMs hosted on the machine.

 

[Baum]

Silicon is just a cheap crystal, if a computational flaw can't be patched without performance hit inside an actual cpu achitecture then i would DEMAND replacements free off charge.

For older cpu's there is a certain lifecycle/usefull product life they should recieve software patches at any cost not to create infected zombies othe than that no nostalgia for electronics, if it has a flaw keep it or trash it....

 

[TheOne]

Has any manufacturer released a microcode update to Haswell and lower systems? Also has anyone done a comparison of performance before and after the software and microcode update?

 

[Morgoth]

yea sure i would like 30% from 16000 usd of my xeons back

 

[OneMoar]

No because I don't think anybody did anything _wrong_ here
the attack is a technique for exploiting modern processor architecture. not a intel/amd/arm fkup

and the attack surface is narrow,yes there are proof of concepts out that show it doing things
but you can do those things already with much easier to implement and deploy exploits and payloads

the attacks require SYSTEM level privilege when browsers/java have been patched, if malware has SYSTEM PRIVILEGES you are PWNT

 

[droopyRO]

My vote was " Not as long as fixes are provided ". That is conditional on the "fix" being easily applied.

I'm not. Got a replacement card and a partial refund. But that situation isn't the same as the whole Meltdown & Spectre problem. NVidia deliberately released a product making a claim of certain specs without fully disclosing that there were problems that would be encountered. What they should have done was release the card with only 3.5GB of VRAM at 224bits. Would have been just fine. But the MLTDN&SPCTR problems are not a disclosure, design, defect problem. They are an unforeseen vulnerability in the way CPU's function normally, one that has existed since the 90's.

I was joking, had the card from launch in oct 2014 up to july 2016 when i bought a 980Ti. Never had a problem with it, and very few games that occupied more than 3GB of vRAM even on 1440p.