The IT Nerd

Since the Spectre and Meltdown CPU flaws first became public, Intel has been on the case to fix them. The thing is their fixes have the effect of slowing down the CPU’s ability to process data, and various people and media outlets have documented that. And it appears that Intel is none too pleased about that because thanks to a reader who tipped me off about this, they tried to restrict benchmarking of their fixes:

Intel is updating its loadable CPU microcode to handle various side-channel and timing attacks. There is a new license term applied to the new microcode:

You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results.

Since the microcode is running for every instruction, this seems to be a use restriction on the entire processor. Don’t run your benchmarker at all, not even on your own software, if you “provide” or publish the results.

I say tried because once this became public, there was an epic backlash as one would expect. That forced the CPU giant to go into damage control mode via Imad Sousou, the GM of Intel’s Open-Source Technology Center:

We have simplified the Intel license to make it easier to distribute CPU microcode updates and posted the new version here: https://t.co/x5JByIv3j9. As an active member of the open source community, we continue to welcome all feedback and thank the community. #IAmIntel

— Imad Sousou (@imadsousou) August 23, 2018

Well at least they listened and took action quickly. But one has to wonder why they even tried to do this in the first place as you would have to imagine that this was going to be the outcome 100 times out of 100. I guess that the fact that their CPUs take a performance hit to some degree or another because of these fixes is a really touchy subject over at Intel.

It appears that Intel is having a #MeToo moment.

Intel has put out a press release in the last hour saying that CEO Brian Krzanich has resigned after it came to light that he had a “consensual” relationship with an employee:

Intel was recently informed that Mr. Krzanich had a past consensual relationship with an Intel employee. An ongoing investigation by internal and external counsel has confirmed a violation of Intel’s non-fraternization policy, which applies to all managers. Given the expectation that all employees will respect Intel’s values and adhere to the company’s code of conduct, the board has accepted Mr. Krzanich’s resignation.

Now taking over on an interim basis as CEO is Robert Swan who was the CFO.

The first thing that I thought of when this came to my attention was the Mark Hurd gong show that went down while he was at HP. Though he did eventually resurface at Oracle. I guess a similar reinvention is what Krzanich is hoping for. But in the here and now, Krzanich is dealing with optics that don’t look too good.

Here we go again.

Sometime today, we’re going to get details on eight… Yes eight CPU flaws that are being dubbed “Spectre NG” or Spectre Next Generation. First, here’s the details from Reuters:

Researchers have found eight new flaws in computer central processing units that resemble the Meltdown and Spectre bugs revealed in January, a German computing magazine reported on Thursday. The magazine, called c’t, said it was aware of Intel Corp’s plans to patch the flaws, adding that some chips designed by ARM Holdings, a unit of Japan’s Softbank, might be affected, while work was continuing to establish whether Advanced Micro Devices chips were vulnerable… The magazine said Google Project Zero, one of the original collective that exposed Meltdown and Spectre in January, had found one of the flaws and that a 90-day embargo on going public with its findings would end on May 7…

“Considering what we have seen with Meltdown and Spectre, we should expect a long and painful cycle of updates, possibly even performance or stability issues,” said Yuriy Bulygin, chief executive officer of hardware security firm Eclypsium and a former Intel security researcher. “Hopefully, Meltdown and Spectre led to improvements to the complicated process of patching hardware.”

The reason why

Neowin also reports that Intel is expected to release microcode updates in two waves; one in May, and the other in August. But it also says this:

That being said, it appears that Google’s Project Zero may have discovered at least one of the eight vulnerabilities a while ago, and their stringent 90-day non-disclosure window may be very close to lapsing, perhaps as early as May 7, if sources are to be believed. After that, their policy is to publicly release information on the vulnerability, regardless of whether a fix is out.

Which means that this is about to get very real very quickly. I’ll be watching this story and I’ll be posting updates as new info comes to light.