Technology

AMD told MrBruh that all update communications now use HTTPS and that updates undergo signature verification. The researcher says he verified the HTTPS claim, but found only a CRC32 check on the downloaded executable, which is not considered a cryptographic signature.

This is the most shocking part. You’d think that AMD as a high-tech company has some smart people working for them. These are very basic things that any half decent programmers should get right. If at no part of the process of implementing this anyone brought up that this is not secure, that is extremely worrying and indicative of a very broken development process. It’s not like a proper cryptographic signature costs extra. This is just pure incompetence.

Didn't Microsoft just pull this same thing and now there's all these 0-days getting released publicly as vengeance? I swear, all these companies are sharing the same brain cell...

What a stupid expectation. A company with a market cap of 700 billion can't just throw 10.000 bucks around. Ya'll need to think of the sustainability of the company.

They really do be stepping over dollars to pick up pennies.

Or in this case, to save them.

Nothing quite like creating a specific incentive for researchers to seek "alternative" sources of income as payment for their research efforts.

Microsoft tried this .. seems to be working out for them .. not.