Excellent way to encourage responsible disclosure.
/s
this post was submitted on 14 Jun 2026
0 points (NaN% liked)
Technology
87417 readers
3818 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
They should ask Microsoft about those current troubles.
Holy crap. I'd say not to buy AMD if you value your security (i have an AMD CPU and the Deck too). You already know the next vulnerability they're going to be the last ones to find out. In the news, probably.
The Steam Deck does run Linux right? Generally that means the used drivers are not written by AMD and also do not have an auto-updater from AMD. The deck is supposed to update through it's OS'es package manager and supposedly has the Mesa and Linux Foundation drivers in use.
AMD does contribute to MESA and kernel driver. It's all open source, but they do lot of heavy lifting regardless
Researcher commenting on the patch:
he remarks that the software only checks the validity of the downloaded file using the ancient CRC32 hash that isn't considered cryptographically secure anymore
I have to respect the researcher for his incredibly charitable wording here. CRC32 is not even remotely crypto. That's never been its purpose, and using it for digital signing is patently insane!
I fear I would have had a much shorter temper after what he's been through, and yet here he is keeping his cool and his criticism constructive. Good on him.
Do you really need signing if you're using HTTPS though?
A drug dealer with a heavily armed escort delivers a package of white powder. New problem: is it cocaine, cleaning detergent, anthrax, or some mixture of the former?
The obvious solution to this is to not seek the bug bounty. The next time a critical security vulnerability is found, sell it to the highest bidder. I'm sure there are black hats out there willing to pay the money that the megacorp refuses to pay out.
That is essentially the behavior AMD is incentivizing here.
Every major company is fucking evil
Read the article
Are you saying that to yourself? Yes, you should read the article.
I did. That's how I know you didn't and just reactionary posted to the title to emotionally manipulate other posters for Updoots.
You're the evil one here.
Y'all really need to read past the headline:
the bug that Paul found seemingly wouldn't be triggered anyway, as the relevant section of the code wasn't being called to begin with
I guess it's one of those "justifiable but unwise" sort of things. If your company is doing a bug bounty program to stay on top of security vulnerabilities, what you don't want is to create the perception that the work of devs who look for these vulnerabilities isn't appreciated, for example, by skimping on bounties over technicalities.
Paying the 10k doesn't ruin the company and allows them to fix a section of code that may become a vulnerability in the future. Not paying the 10k saves them 10k at the price of the devs' trust that keeps this program effective. From a financial point of view, this is some very poor decision making.
If it's in the code, it's a bug. If it's not used, then remove it entirely. Everything in the code should be treated as operational.