Re: What didn't I know and when didn't I know it?
Those are strong words - should, must, etc
A paper stating "it must be secure" has little value. Any more than one saying "steps must be taken to ensure world peace."
It has to be paper that is practical, specific to the issue and peer cited so that it is isn't an obscure one.
i.e ensure that during OoO execution all HW access protection rules are honoured and considered. Even saying "HW access protection rules must be honoured" on its own is no good. There has to be something specific that constrains the attack surface so that the development cost is sensible. That is a valuable paper, because that is the challenge to get secure designs. i.e. when you have a 100 million lines of code, how do you make it secure?
"Professionals are meant to be masters of the body of knowledge in their profession. Lawyers, for example. And chip designers."
Fact - All major vendors affected - Intel, AMD, ARM, Apple, Qualcomm, etc i.e. This issue was not typical of the knowledge of the profession. All face the issue in different manifestations.
From Intel T&C of sale, their caps, emphasis mine
"SELLER SPECIFICALLY DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY AND FITNESS FOR A PARTICULAR PURPOSE, WHETHER OR NOT SELLER HAD REASON TO KNOW OF ANY SUCH PURPOSE, AND ANY WARRANTY AGAINST INFRINGEMENT OF ANY INTELLECTUAL PROPERTY RIGHT OF A THIRD PARTY. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY SELLER OR AN AUTHORIZED REPRESENTATIVE SHALL CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF THIS WARRANTY. PURCHASER ACCEPTS THE RISKS OF USE AND SUCH RISKS FALL SOLELY ON PURCHASER. "
That's the Intel lawyers being masters of their profession. By the same logic, if Intel lawyers are masters of their profession, there is no court case. But that is not proven yet either.
Both (chip designers and lawyers) have taken step typical of their profession, this is what the present evidence says.
Biting the hand that feeds IT
