3 ms·
if you do not apply spectre/meltdown migtation on non virtualized hardware which only you control you are safe. of course a malicious process could do harm with
by merb 9y ago
if you do not apply spectre/meltdown migtation on non virtualized hardware which only you control you are safe. of course a malicious process could do harm without them, but a malicious process probably can be as harmful, even if you have the patches applied.
basically we need these patches since on the internet a ton of stuff lives on virtualized hardware and there you can actually be harmful to other vms or even the host itself.
basically spectre/meltdown needs to be applied in hosted environments and on clients.
on everything else it's way less scary than on those two environments.
- msbarnett 9y agoDo you also run all processes on your server as root? If you’re not going to apply patches that close privilege escalation bugs, you might as well. You’re putting all your security eggs in one basket.
- merb 9y agoWell a lot of processes run as Root anyway. Also if possible i run as few processes as possible
- pixl97 9y ago>Well a lot of processes run as Root anyway. Then you didn't listen to DJB like 15 years ago. Moreso, your processes shouldn't be running under the same username. Principle of least user authorization people.
- merb 9y agoplease just install a linux distribution and run ps aux. a ton of stuff just runs as root. either because there is no other way or because it's a bad default.
- msbarnett 9y agoYeah it’s your job as a Unix dev or admin to not stick with crummy but convenient defaults, kid. Nothing exposed to the web or touching anything exposed to the web should be running as root. Each thing should be running under its own, very limited, user and group. If something gets hacked, you want it to be as least privileged as possible. We know how Unix works. We’re telling you because you clearly are out of your depth. If you don’t understand that you have no business maintaining anything on the internet.