AMD didn't deny it was a vulnerability; they denied it was in the scope of the bounty program.
Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.
What hair is this splitting? The issue was that AMD allowed a known and serious security vulnerability to exist within their customers’ systems, for months, and acted with a lack of candor while doing so.
A non-default-installation set of AMD tools (Ryzen Master and probably others) had an auto-updater which used HTTP instead of HTTPS. It's clear this is a feature they'd basically forgotten about; it even pointed to an ATI domain. A third-party bug bounty company rejected it because MITM was out of scope. AMD are incompetent at making software (news at 11), kept asking for extensions, and took an incredible amount of time to deal with it. Eventually they removed this updater entirely and replaced it with one in the app (rather than the installer) that uses HTTPS + a CRC32 (for some reason). The initial vuln was very stupid and should have been fixed faster. As for the current system, if you're mad about HTTPS-protected auto-updaters (which is valid), you've probably got a lot of them to go to war against.
AMD didn't deny it was a vulnerability; they denied it was in the scope of the bounty program.
Remember that at giant tech companies, the incentive is to pay out bounties --- there are people on the vendor's team whose performance is measured in part by how much the program pays out.
What hair is this splitting? The issue was that AMD allowed a known and serious security vulnerability to exist within their customers’ systems, for months, and acted with a lack of candor while doing so.
It's not hair-splitting; it's central to the idea of a bug bounty. Too many people have weird ideas about what bug bounties are for.
Yeah, like the weird idea that those programs are intended to in some way reduce the number of exploitable bugs actually out there.
That's in fact often not their core purpose!
What is it?
... which is why the rest of us should give them, and those who operate them, zero respect.
Nobody but AMD gives a fuck about AMD's internal policies or motivations.
They wanted to keep it quiet. As if they did not mind if it was exploited by those with access to international network links.
The discussion the video references [1]
[1] - https://news.ycombinator.com/item?id=46906947
The original post [1] now includes an update:
[1] https://mrbruh.com/amd2/Actual write-up rather than overwrought YouTube drama: https://mrbruh.com/amd2/
A non-default-installation set of AMD tools (Ryzen Master and probably others) had an auto-updater which used HTTP instead of HTTPS. It's clear this is a feature they'd basically forgotten about; it even pointed to an ATI domain. A third-party bug bounty company rejected it because MITM was out of scope. AMD are incompetent at making software (news at 11), kept asking for extensions, and took an incredible amount of time to deal with it. Eventually they removed this updater entirely and replaced it with one in the app (rather than the installer) that uses HTTPS + a CRC32 (for some reason). The initial vuln was very stupid and should have been fixed faster. As for the current system, if you're mad about HTTPS-protected auto-updaters (which is valid), you've probably got a lot of them to go to war against.
Gaslighting does not mean lying.
Such a bug could have been exploited by certain big state actors.
Those that have access to international network links.
Those that have the ability to generate new firmware that simply passes the CRC32 checksum.