525
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 12 Aug 2024
525 points (100.0% liked)
Selfhosted
39677 readers
208 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
That's so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.
Intel vs. AMD isn't "bad guys" vs. "good guys". Either company will take every opportunity to screw their customers over. Sure, "don't buy Intel" holds true for 13th and 14th gen Core CPUs specifically, but other than that it's more of a pick your poison.
Tangent: If we started buying risc-v systems we might get to a point where they can actually compete.
That's still far away from us as a consumer standpoint, but I'm eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities
I‘m more on the builder/tinkerer side so I‘m pretty much in starting position with risc-v now. But yes, its going to be some time before any of it is user ready as a pc.
Framework has a laptop in progress if you're interested
Indeed I am. I‘m in posession of a working laptop but I could maybe order a riscv tablet from pine64. I already have the pinetime and the stuff is pretty awesome.
Well the Star64 from Pine is pretty good, just doesn't have enough processing power and IO for my liking.
It is crazy efficient
As in efficient per watt or some other metric?
Per watt
I'm not buying hardware that doesn't suit my needs as an investment hoping maybe it eventually will.
This is one of the hardest earned lessons I’ve ever learned, and I’ve had to learn it over and over again. I think it’s mostly stuck now but I still make the same mistake from time to time.
Yeah, thats the reason why we‘re in this capitalist hellhole. Perfection comes from billionaire money, nothing else.
What are you talking about perfection?
Buying something that doesn't function is never rational.
Jeff Geerling had a video recently about the state of RISC V for desktop. https://youtu.be/YxtFctEsHy0?si=SUQBiepSeOne8-2u
I really enjoyed watching it. Thanks for referring to it.
I'm waiting to see how DeepComputing's RISC-V mainboard for the Framework turns out. I'm aware that this is very much a development platform and far from an actual end-user product, but if the price is right, I might jump in to experiment.
Sounds like a cool idea! :)
At the rate we are going Qualcomm might pivot to Risc-V (they are being sued by ARM)
Interesting! Thanks for chiming in. I‘ll read up about it.
How is AMD "screwing us over"? Surely they aren't doing this on purpose? That seems very cynical.
They are 100% not patching old chips intentionally by not allocating resources to it. It's a conscious choice made by the company, it is very much "on purpose".
That's not what I was referring to. I was referring to the act of "adding vulnerabilities". Surely they aren't doing that on purpose. And surely they would add fixes for it if it was economically viable? It's a matter of goodwill and reputation, right?
I don't know, I just don't think it's AMD's business model to "screw over" their customers. I just don't.
What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).
I don't classify fixing critical vulnerabilities from products as recent as the last decade as "goodwill", that's just what I'd expect to receive as a customer: a working product with no known vulnerabilities left open. I could've bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!
I know some people say it's not that critical of a bug because an attacker needs kernel access, but it's a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.
Maybe they'll reverse course with enough blowback, they did that once with ryzen already, don't remember which Gen it was but it wasn't going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.
Similarish situation could happen here, the biggest hangup I'd think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.
Well, you feel how you feel, and you choose the products you want after this. Good luck to you! 👍
Edit: So many down votes for wishing someone good luck. The hive mind is odd sometimes.
No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It's not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don't want to fix even though they absolutely could.
I'm guessing it's a balance between old products, effort, severity, etc. As we've learned, this is only an issue for an already infected system. 🤷♂️
Ryzen 3000 series CPUs are still sold as new, I even bought one six months ago, they're no where near being classified as "old", they're hardly 5 years old. And this is not only an issue for already infected systems because uninfected systems will intentionally be left vulnerable.
Ah, that changes things. Not great. But still,
what I meant was that apparently only compromised systems are vulnerable to this defect.
That is not correct. Any system where this vulnerability is not patched out by AMD (which is all of gen 1, 2 and 3 CPUs) is left permanently vulnerable, regardless of whether or not they already are compromised. So if your PC is compromised in a few months for some reason, instead of being able to recover with a reinstall of your OS, your HW is now permanently compromised and would need to be thrown out...just because AMD didn't want to patch this.
No, but those vulnerabilities where there when you bought it.
Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.
Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.
I mean... A car is different, depending on the defect. It's like "this window only breaks if you've already crashed the car". (The defect only causes a vulnerability if the system is already compromised AFAICT.) And 5 years is much, much younger for a car compared to a CPU, but that's not the important bit, I know.
But I agree with you all, I am not saying it shouldn't be fixed, I was just saying I don't think AMD is looking to screw over their customers on purpose. That's all.
No, it's usually more like "this thing will break and cause a car crash" or "this thing will murder everyone in the vehicle if you crash". And companies still will not fix it. Look at the Ford Pinto, executives very literally wrote off people's deaths as a cost of doing business, when they'd turn into fireballs during even low speed rear-end collisions. Potentially burning down the car that hit them too.
Edit: I mean, just look at the Takata airbag recall. 100 million airbags from 20 different carmakers recalled because they wouldn't activate during a crash.
When I said "It's like", I meant it as a simile to what's going on with AMD right now. Not with what's actually going on with car companies. Car companies are a whole different topic and discussion, of which I know nothing.
The cost isn't that high. They're already doing it for a bunch of parallel systems.
In a just world they'd be legally required to provide the fixes, or fully refund the entire platform cost. It's not remotely ethical to allow this to exist unpatched anywhere, regardless of support life.
“Both sides”
“Vote third party!”
Wtf seriously this isn’t the same thing remotely but the arguments used are.
cmon man