Colin Percival says a scholar's duty is to find the people who need the truth
In 2004 he found that Intel Hyper-Threading leaked an RSA key through the cache, spent six months notifying vendors, and published in May 2005 over Intel's objection.
Intel pressed Yahoo, his employer at the time, to withdraw the paper. Yahoo said he was not their employee. He presented at BSDCan on May 13, 2005, and several operating systems published advisories at the same time.
In the thread, Percival added a link to a 2020 essay, and commenters recalled Intel's response.
Six months of quiet phone calls
In his essay, Percival recounts finishing an Oxford thesis when he found that Hyper-Threading could leak information between threads through the CPU cache. By mid-December 2004 he had a proof of concept that extracted enough bits of an RSA private key to rebuild it. He spent about six months alerting security teams so patches would be ready. FreeBSD, NetBSD, Red Hat, SCO and Ubuntu issued advisories around the BSDCan talk.
His argument draws on engineering ethics codes and the philosopher Fichte: a scholar must actively find the people who need the knowledge. Researchers create it; scholars deliver it. The duty ends when everyone able to act has been told.
Intel's answer, then and now
"Timing exploits has been known to the security community since the mid-nineties. From a real world standpoint the attack is not practical." — a commenter quoting Intel's 2005 response
John Nagle replied that today it would matter more, because AI has "patience limited only by your budget" when exploiting hard-to-exploit holes.
Who actually follows the code
A decade-long IEEE member quoted the essay's point that IEEE members commit to protecting public safety, and said he has never seen anyone besides the author take that duty seriously.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
This is the last story in the November 1, 2026 issue.
Go to the issue archive