Staying ahead of the AMD vulnerability known as “Zenbleed” (opens in new tab)

As someone who has dealt with a lot of upper management, I can say that they love articles like this coming from one of their infrastructure providers. It gives them a feel-good feeling, and probably avoids unnecessary emails to their support staff on whether they've done anything to mitigate the risk.

The real genius was OpenBSD adding microcode updates they should have had for 10 years, and on top we get a smug Theo email about how it's really not even very much affected except when using AVX (duh).

Sure but they didn’t do anything here but apply a microcode patch…

Heck they are taking attention away from the original authors and what shining a spotlight at their hardware partner’s flaw?

If you’re right, that’s still (comparatively) a lot of English to communicate very few bits of information. If I cared, I’d honestly be a bit miffed that they made me spend a minute on this shaggy-dog post/ad chimera instead of putting a single sentence in the announcements section of their front page or dashboard (which is a section that needs to exist if it doesn’t already). Like

  2023-07-25: Microcode patch for [Zenbleed](https://lock.cmpxchg8b.com/zenbleed.html) ([CVE-2023-20593](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20593)) now rolling out across fleet, expected complete 2023-mm-dd, no evidence of exploitation so far.

Was that so hard? TFA doesn’t even give an estimated completion date, so that’s actually more info than the original! (If they don’t have one yet, that’s OK too of course.)

If the post actually did a better job than other sources of explaining the problem to at least some potential audience, I would’ve welcomed it, and in fact I’m probably crabby exactly because I’ve come to expect good and frank technical explanations from the Cloudflare blog (whatever I may think of their business). But this one is just meh, with a sprinkling of bleh from the forced cheer in the title.

(Sez I who has just spent 200 words’ worth of English just to complain.)

I figured the default assumption was these vendors kept updated with security patches.

Do we really need a blog post every-time they run apt/yum update?