Beyond Silence: A Scholar's Duty to Share Security Flaws

The author recounts discovering a cache-based side channel vulnerability in Intel’s Hyper-Threading feature that could leak RSA private key material. Rather than publish immediately, the author spent six months on coordinated disclosure, prioritizing this responsibility over career and education obligations. Being single, childless, and able to live rent-free in Canada while managing type 1 diabetes expenses made this extended effort possible. The vulnerability was publicly disclosed on May 13th, 2005 at BSDCan, with advisories following from FreeBSD, NetBSD, Red Hat, SCO, and Ubuntu. Intel, however, attempted to suppress publication by pressuring Yahoo (the author’s non-employer) to force withdrawal.

The article extends this experience into a broader argument about duty: both professional engineering codes and philosophical tradition—particularly Fichte’s concept of the scholar’s vocation—establish that those with specialized knowledge have a moral obligation to share it responsibly with those who need it. This requires actively identifying who should know and reaching out quietly to allow time for remediation, not merely publishing widely. The author illustrates this principle beyond security vulnerabilities through a 2009 AWS Path MTU Discovery issue that was reported to Amazon, then publicly discussed via blog in November 2012 after Amazon showed no signs of addressing it.