On November 16th, 2004 — π years after arriving at Oxford — the author submitted their doctoral thesis, but their mind was elsewhere. They had discovered a critical vulnerability in Intel’s Hyper-Threading technology, introduced in 2002, which allowed information leakage between execution threads via cache state. Recognizing this as a potential cryptographic side-channel, the author developed a proof-of-concept exploit by mid-December that could reconstruct an RSA private key.
Rather than publish immediately, they spent the next six months quietly working with security teams to fix the issue before public disclosure — a process now known as coordinated disclosure. Despite pressure from Intel and Yahoo, who attempted to suppress the paper, the author presented it at BSDCan on May 13th, 2005, alongside advisories from Free BSD, Net BSD, Red Hat, SCO, and Ubuntu. The author emphasizes that finding a vulnerability carries an ethical duty to notify the right parties quietly, not to ignore or sell it.
Their ability to act was enabled by personal circumstances: being single, child-free, and living rent-free in Canada — a privilege not available to many, especially in the U.S. where health insurance and employment would have constrained such efforts. The article draws a parallel to engineering ethics, citing the IEEE code which mandates prioritizing public safety regardless of employment status.
Source: Hacker News · Summarized by HeadlinesBriefing