AMD faces customer and shareholder Spectre lawsuits

[HEXUS]

There are now two class-action suits from shareholders and three on behalf of customers.

Read more.

[CAT-THE-FIFTH]

32 to 5,looks like Intel is "slightly" worse off.

[afiretruck]

AMD claimed "near-zero risk of exploitation", yet still provided BIOS updates - a 'smoking gun' think lawyers.

"near-zero" != "zero"

If these BIOS updates make it "zero" or closer to that, then I don't see what the problem is here.

[lumireleon]

We are so worried about spectre yet Microsoft and Google are siphoning all our sensitive data to their servers 'un-hidden' ...contacts...images...GPS information...name it!

[shaithis]

We are so worried about spectre yet Microsoft and Google are siphoning all our sensitive data to their servers 'un-hidden' ...contacts...images...GPS information...name it!

The difference is, MS and Google aren't using the data to scam you, empty your bank accounts etc

[Corky34]

I do love the claim from shareholders that AMD unjustly profited from the sale of affected processors after knowing about the vulnerabilities, would they have preferred for them not to release an upcoming product, throw them all into a landfill, and write down all those assets.

Doing that probably would have ended AMD and with it the value of their stocks.

[LSG501]

While I'm not saying intel and to a lesser extent amd shouldn't be held responsible for the issues, this 'bug' wasn't found (supposedly) until roughly 10 years after the architectures that all these cpu's are based on was released....

Also everything I've read so far seems to imply that AMD is 'easier' to fix, with less overall impact than intel, and they're actively doing this. So I don't see why them releasing a product that's been in 'development' for several years, so before we knew about spectre etc, is as bad as the shareholders are making out... this seems more like the shareholders are trying to get some quick cash than actually being concerned about users.

Personally I don't mind the NDA part and keeping it quiet to allow time to sort a fix (unlike google who will release info about other companies bugs after 90 days no matter what)to 'protect users' because it's far more appropriate when it can affect a lot of users but the issue I have is that they didn't have the fixes ready to go on the planned date where the nda would be cancelled...especially intel. I could understand them being sued because of the 'delay' in fixing the 'bug'.

[Troopa]

5 is still bad enough. Eric Cartman on you both.

[ETR316]

arm also.

[Xlucine]

While I'm not saying intel and to a lesser extent amd shouldn't be held responsible for the issues, this 'bug' wasn't found (supposedly) until roughly 10 years after the architectures that all these cpu's are based on was released....

Also everything I've read so far seems to imply that AMD is 'easier' to fix, with less overall impact than intel, and they're actively doing this. So I don't see why them releasing a product that's been in 'development' for several years, so before we knew about spectre etc, is as bad as the shareholders are making out... this seems more like the shareholders are trying to get some quick cash than actually being concerned about users.

Personally I don't mind the NDA part and keeping it quiet to allow time to sort a fix (unlike google who will release info about other companies bugs after 90 days no matter what)to 'protect users' because it's far more appropriate when it can affect a lot of users but the issue I have is that they didn't have the fixes ready to go on the planned date where the nda would be cancelled...especially intel. I could understand them being sued because of the 'delay' in fixing the 'bug'.

Google was part of the consortium fixing this, and held off on disclosure for well beyond the 90 day limit in this (spectre/meltdown) instance

[LSG501]

Google was part of the consortium fixing this, and held off on disclosure for well beyond the 90 day limit in this (spectre/meltdown) instance

Yes, and that's my point... if it affects them (ie their servers etc) they're more than happy to hold off past their self imposed 90 day limit on bugs that they find (they also found this one) but on things which could actually affect people a lot easier, ie a browser bug that isn't relating to chrome, they'll release it without any concern for how it might affect the public, even if a patch is actively being worked on.

[Tabbykatze]

Yes, and that's my point... if it affects them (ie their servers etc) they're more than happy to hold off past their self imposed 90 day limit on bugs that they find (they also found this one) but on things which could actually affect people a lot easier, ie a browser bug that isn't relating to chrome, they'll release it without any concern for how it might affect the public, even if a patch is actively being worked on.

I think you're being a narrow minded/tin foil hat in your opinion there. There is a possibility that they took that reasoning or perhaps it's more because the vast majority of the "internet" we use is cloud hosted and these bugs allowed malicious entities to access data held within other customer islands. Azure and Amazon in that moment of discovery became one of the least secure systems, post intrusion mind, on the market. So that's why they held back, because releasing something that affects...pretty much 100% of all systems out there has a CPU in it is a pretty big problem. Could you imagine the types of malware that could have been made and deployed worldwide. It could have disassembled every form of security we know in a matter of days/weeks (extremist doomsayer over). It'll make Wannacry, heartbleed and the lovebug look like a mild ant infestation.

So it was in the worlds best interest that they hold back. Now, your point about small software which in the grand scheme of things is less complex and less likely to affect the world as a greater whole is a different story. 90 days is generally more than enough time to devote resources to identify the issue, analyse the issue, fix the issue and perform limited QC and then release to the public. What Google is doing is a double edge blade, they are saying to software developers: "Pull your socks up else we'll rip your pants down, sort it out". But Software developers are inherently lazy due to management, oversight, lack of information and many other factors.

Google is forcing companies to publicly acknowledge their problems if they don't sort them out first. One of the biggest problems in tech today is when companies want to "dust the problems under the rug" and most of the time, they get away with it.

The reason why it's a double edged blade is if the software developer does not release a fix then they've just announced that vulnerability to the malicious world and it's open season.

To me, that side of Google is a "Chaotic Good" type of person.