8 ms·
How Tier 2 cloud vendors banded together to cope with Spectre and Meltdown
- jordanthoms 9y agoAll this seems like a pretty compelling reason to move to using VMs and type safety to provide process isolation instead of using the hardware, e.g. https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death... or Microsoft's Singularity and Midori projects. It's a shame there's so much inertia behind the current setup of hardware memory management etc that it seems it'll be a long time before anything actually happens here.
- runeks 9y agoHow would this approach have helped in this case? As I understand it, the flaw in question allows reading kernel memory by executing user space code. How can a layer of software, on top of this type of buggy hardware, fix this issue? In one sense, the issue has already been fixed by a layer of software on top — which restricts a bunch of stuff, and reduces performance — but I assume this isn’t what you’re looking for.
- jordanthoms 9y agoThose systems don't use the buggy aspect of the hardware (memory protection) at all. Instead, all code is run inside a VM which provides memory protection and process isolation - there is no 'native' code at all. Not using the hardware memory protection provides a ~20% performance boost, which makes up for the ~20% overhead of running everything through VMs.
- peterwwillis 9y agoNote that Google released information a week early, giving attackers a leg up in attacking these cloud providers, as opposed to Google giving the cloud providers the information immediately, which would have helped them defend themselves. But, surprise: Google is their competitor. Google is basically the new Microsoft, except Microsoft could actually design working products when it was evil.
- Meai 9y agoWhat's with these random jabs at companies, you are just trying to create a culture of irrational dislike. I don't even care if you attack Google but everytime you do so, you have to cite exactly why you are doing it. Not some nebulous "oh they cant even make a single working product" which is objectively false and just provocation.
- peterwwillis 9y agoOne, you're attributing something I never said, and two, my actual claim is not objectively false. Three, I don't have to do anything, much less prove what is otherwise easy to find out via Googling. And four, it's not irrational dislike, it's dislike based on personal experience and observation. Five, it should be pretty obvious exactly why i'm attacking Google, it doesn't need citing (unless the reader can't put two and two together, vis a vie "Google uses its privileged embargo status to disseminate sensitive information in a way that harms its competitors")
- Moter8 9y agoFYI, the submitter is someone from Scaleway, so he perhaps would also answer some questions on what infos they had or something.
- mikmak 9y agoeverything we have at Scaleway is on our blog http://blog.online.net http://blog.online.net things are calming down now, we known what are the fixes for the known bugs and their limitations We can probably expect more OS patches in the coming weeks to improve performances and potentially fix new variants of these bugs that could come in the future
- logronoide 9y agoThe more I know about how Intel has managed the information, the less I trust them. What a disaster. CEO and all the Press and Communication team of Intel should be fired
- deleted 9y ago[deleted]
- xupybd 9y agoShouldn't the CEO be investigated for insider trading?
- brianwawok 9y agoWhy? Intel made billions last year. They will make billions this year. They will make billions next year.
- mschuster91 9y ago> Why? Because the fallout will cost billions over the next years. Intel as a company due to class-action lawsuits, recalls, rebates, and the shareholders because the drop in stock value after the announcement will cost them quite a chunk of money. In addition, more long-term, I sincerely hope that the cloud vendors (and maybe even Apple!) recognize that their total dependence on Intel (and NVIDIA in deep learning...) is bad and they need to diversify their base.
- gaadd33 9y agoYou do know that INTC is up compared to 1 month ago? If it didn't drop that much on the initial announcement, why would it plummet in the coming months?
- mschuster91 9y agoBecause there is no quantifiable impact yet. Right now all that's known is "mh, it's bad, but the OS vendors are patching it"... now give the situation a couple weeks to brew, wait for more data on the CPU impact of these patches and the inevitable lawsuits. Plus, Intel might want to think about delaying the next CPU releases (or introduce a new stepping of existing CPUs) to fix the bugs in hardware... all stuff that ain't cheap.
- alanpost 9y agoPrgmr.com has been participating on the Slack channel this article mentions. Being able to share notes gleaned from reaching out to vendors and sort through the information and mitigations for Spectre and Meltdown has been a huge help.
- thepumpkin1979 9y agoWhat's the advantage of Prgmr?
- alanpost 9y agoYou can manage your VPS over SSH using our management console.[1] Since most of our users access their VPS using SSH, it's nice to use the same protocol for powering a machine off and on or accessing the serial console. By and large our customers know what they're doing. That lets us provide IRC and email-based support that has been described more as working with a colleague than interacting with a vendor. This can be helpful when, for example, a user self-hosting email receives a complaint or has a delivery issue. Most of the time though we just get out of the way and let you work on your VPS. 1: https://wiki.prgmr.com/mediawiki/index.php/Management_Console#Latest_Management_Console https://wiki.prgmr.com/mediawiki/index.php/Management_Consol...
- paulzerkel 9y agoI work for a cloud computing company that would have benefitted (and hopefully contributed) from being on that Slack. If you have the time, would you mind reaching out to me with details? My email is in my profile.
- alanpost 9y agoHere is where I asked to join: https://twitter.com/prgmrcom/status/949023633581592576 https://twitter.com/prgmrcom/status/949023633581592576 Following up to @scaleway on Twitter in the same manner would hopefully work out. I've sent you an email with a bit of elaboration on this.
- walterbell 9y ago
- alainv 9y agoSaved you a click: by starting a shared Slack for their teams to collaborate. Neat factoid but this article is not exactly information-dense.
- comboy 9y agoAnd now there are "Tier 3" companies that didn't get invited to the slack channel. It all helps big get bigger and making life harder for smaller companies. Not a great setup for a healthy competition.
- jo909 9y agoI don't think the actual technical "how" is of much importance so the article doesn't spend much time on it. They communicated effectively, and more important openly, over company boundaries. Many tools would have worked for that. This is about "how" they banded together to reduce their disadvantage compared to the big cloud providers that had advance warning and insider knowledge/access to the vendors long before the rumors started.
- alanpost 9y agoCorrect. It's the ability to share documents and conversation snippets provided by vendors, as well as curating and summarizing the significant amount of information available. I've never seen an exploit that involves microcode updates, compiler fixes, kernel patches, and KVM/Xen updates all together. The number of moving parts is staggering. Being able to filter and summarize that across company boundaries has helped me both understand and more effectively work to mitigate this problem.
- papermule 9y agoThis is a great example of collaboration between competitors where there is much to be gained and nothing to be lost!
- Blazespinnaker 9y agoI’ve said many times this is the best way to deal with the large monopolistic companies - group up.
- mythas 9y agoThen suddenly he said, “I have it! We are going to swim all together like 0.1% of the biggest fish in the sea!” ~ Leo Lionni, Swimmy