Foreshadow

[Aretak]

Attempting to stop people from reporting on any performance loss is a whole new level of shady.

 

[Panos]

Have people seen this:

https://sconedocs.github.io/microcode/
https://labs.vmware.com/flings/vmware-cpu-microcode-update-driver/comments

That is the microcode update for Intel CPUs under Linux for the Foreshadow vulnerability which points to this:

https://downloadmirror.intel.com/28039/eng/microcode-20180807.tgz

The latest microcode updates are listed here so its a valid link:

https://downloadcenter.intel.com/download/28039/Linux-Processor-Microcode-Data-File?v=t

Now if you download,look at the license,which says this:

https://paste.ubuntu.com/p/z2F3Cj6R8Q/



Wait,wut?? People can't benchmark the effect of the microcode update??

Well other parts of the clause have also annoyed Debian:

https://www.theregister.co.uk/2018/08/21/intel_cpu_patch_licence/

No wonder we have seen so few reviews and never accumulative ones but only those looking at a single patch. Like the V4 Spectre or the V2.
The only broad review we had up to now, is old (April) related to Xeon servers and the numbers didn't look good at all.

For consumers, I believe we will start having an idea when Z370 boards are benched with 9xxx series CPUs.
Because to use 9xxx they have to patch the board to the latest bios. Yet also that relies on the reviewers to use a up to date version of windows and not some disk image they did years ago.

But forcing people not to report performance impact on the updates, is very shady and anti consumer tactic.