Dan Guido

The researchers didn’t inform AMD until just before publication as they claimed AMD would never fix the issues. AMD did fix the issues. At the same time as website went live an investment website for shorters issued a large report saying the chips would have to be destroyed (??).

The moderator of /r/netsec somehow got paid over 10k to back up the research in the press, which fed into breathless press stories at the time. Did seem weird everybody involved had a financial incentive.

This was fully disclosed in our blog post, and I stand behind everything we said. I think it's unfortunate how it played out in the press, however, I think we were one of the only voices of reason through it all. https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ …

Second, we weren't paid to "back up" anything to the press. We were paid for a thorough technical investigation of a piece of software. No one can pay me to lie, or hype anything and then promote it on their behalf.

Third, you'll note that even AMD cited our public analysis of the vulnerabilities in their reporting: https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research … I'm not sure how you think I should have acted differently?

Personally I believe it was important you being paid by CTS Labs was mentioned in the reporting, because independent sources matter. However that’s up to reporters to establish and list.

An addendum to my earlier tweet. I didn't learn Trail of Bits had reviewed the PoCs under its standard fee arrangement until two days after I posted my article. ToB should have disclosed the arrangement sooner, and I and all other reporters should have noted it in their articles.