There are many examples of Microsoft and other large corporations treating security researchers well. Microsoft hosts BlueHat, where they invite external parties to talk about their findings. They thank researchers monthly who do contribute reports to MSRC. As I recall, they treated bunnie well, and I think they also treated “hoodie” (the original Xbox 360 hacker) well as well.

https://github.com/google/security-research/blob/master/pocs...

Tavis spells it out there pretty quickly:

“ The simplest instructions (add, sub, mov, etc) are all implemented in hardware. The more complicated instructions like rdrand, fpatan and cmpxchg are microcoded. You can think of them as a bit like calling into a library of functions written in that RISC-like code.”

I don’t know how I feel about micro-ops being executed in hardware - I mostly agree, but also, microcode updates exist…

See also: Jazelle DBX.

Hell, on modern x86 processors, many “native” instructions are actually a series of micro-ops for a mostly undocumented and mostly poorly understood microcode architecture that differs from the natively documented instruction set.

It’s turtles all the way down.

I like using computers to solve problems. I’m more interested in the problem being solved than the journey most of the time, though I’ve also been on some lovely journeys. Sometimes that means I write a tool all by myself. Sometimes it means I download an existing open source tool. And sometimes it means I delegate the creation to an AI model.

There’s ambiguity in the x86 specification, such that you can execute a single instruction and get different results in intel vs amd. See the rcpss instruction, for example.

I get that LLMs are categorically different, and they’re absolutely not as reliable as compilers are, but compilers are also not as reliable as compilers seem. And even less predictable IMO.