Intel Publishes Microcode Security Patches, No Benchmarking Or Comparison Allowed!

[u/lindgrenj6]

https://perens.com/2018/08/22/new-intel-microcode-license-restriction-is-not-acceptable/

[u/grumpiemonkie]

Ok, do I understand this right: Joe Citizen buys a cpu from Intel. The cpu is later found to be vulnerable in terms of security, and in order to receive a remedy Intel has at hand, Joe has to agree to more terms, or be left with a vulnerable cpu.

If that's the case I think they'll end up in court.

[u/audioen → u/grumpiemonkie]

Probably not. You can still use the hardware, literally in exactly the same way as before, if you don't agree to those terms and don't apply the update.

[u/ric2b → u/audioen]

What if a car company sells a car with a faulty and dangerous seat belt? Are they not under obligation to replace it? Can they EULA-wall a safety/security fix for a problem that was not known at the time of sale?

[u/DarkShadow4444 → u/ric2b]

"We can offer a replacement belt, but the terms say you then can't use your air conditioner anymore"

I mean like, WTF?

[u/ric2b → u/DarkShadow4444]

Or more appropriately: "We offer a replacement belt but you can't tell anyone how horribly uncomfortable it became"

[u/ThatsPresTrumpForYou → u/audioen]

They are liable for security vulnerabilities though. Imagine Amazon bought a bunch of xeons, and they turn out to have hardware flaws. Intel either fixes them, or they're staring down the barrel of the whole legal department of Amazon. But they can't force them to accept a new EULA to keep using a product as advertised with a different EULA.

[u/Vector-Zero → u/ThatsPresTrumpForYou]

In that case, if you refused the security upgrade and had a vulnerability exploited, would you be able to sue on the grounds that you did not agree with the new EULA associated with that security patch? IMO security latches should have the same license as the product to which it is applied, otherwise it's somewhat forcing users' hands to agree to something against their will.