Our Interesting Call with CTS-Labs
This is crazymaking. I posted the Trail of Bits technical summary earlier today:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16595184" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16595184</a><p>Trail of Bits --- which has a reputation in the field approaching &quot;unimpeachable&quot; --- confirmed a series of serious vulnerabilities. Whether there are real findings involved in this report isn&#x27;t in question, and hasn&#x27;t been since the day of the announcement, when Dan Guido from Trail of Bits confirmed that they&#x27;d reviewed and confirmed the finding.<p>It&#x27;s ironic, or maybe it isn&#x27;t, that after CTS-Labs published their findings in a manner basically optimized for innuendo than Anandtech has run a story that is basically composed of innuendo. Given how charged people&#x27;s feelings about AMD seem to be, this is probably manna from heaven for them, and since CTS-Labs isn&#x27;t publishing the full technical details, it&#x27;ll be raining bread for them for many days to come.<p>I wouldn&#x27;t care, except that after the original monster thread about the CTS-Lab announcement, it&#x27;s become apparent that HN commenters have a very poor understanding of how vulnerability research actually works, and Anandtech is perpetuating some of those myths, like the idea that researchers invariably (or even routinely) arrange for CVE allocation when publishing new flaws.