The Scholar's Duty: Why Finding a Security Flaw Means Finding the People Who Need to Know
The Duty of a Scholar
In 2004, while finishing his Oxford doctorate, Colin Percival found that Intel's Hyper-Threading could leak data through cache state, and built a proof-of-concept that recovered an entire RSA private key. He then spent six months quietly coordinating disclosure — even after Intel asked Yahoo to pressure him into withdrawing the paper. Drawing on IEEE ethics codes and Fichte's lectures on the scholar's vocation, he argues that knowledge carries a duty to actively seek out the people who need it, not merely to avoid concealing it.
To me, the duty includes actively seeking out people to whom the truth should be told. To hide behind "nobody asked" is to fail to fulfill the duty.
- cperciva
Wow that showed up quickly.
Readers might also consider my 2020 post "On the use of a life" to be an interesting companion piece: https://www.daemonology.net/blog/2020-09-20-On-the-use-of-a-...
- ballmerpoint
> Members of the IEEE commit, for example, "to hold paramount the safety, health, and welfare of the public..." without that duty being limited to hazards arising from projects employing the Engineer in question: The duty "to disclose promptly" vests in any Engineer who recognizes that the hazard exists.
As an active member of the IEEE for over a decade now, I have never seen anyone (aside from the author here) take this duty seriously. There are plenty of IEEE members working on things that directly cause such hazards.
- Animats
The Intel claim it wasn't a problem: [1]
Today, it would be a bigger deal. In the age of AI, exploiting hard to exploit holes is so much easier. AI has
patience limited only by your budget.
[1] https://www.itnews.com.au/news/intel-soothes-hyperthreading-...
- nickelpro
Intel's response was:
> Timing exploits has been known to the security community since the mid-nineties. From a real world standpoint the attack is not practical.
And this is basically the state of the art today, even with Spectre. You can demonstrate the vulnerability under controlled conditions but having those conditions arise in production is not practical in the engineering sense.
- jruohonen
He sounds somewhat like R. K. Merton, and thus it was a good read.