4 ms·

I've went through Denial, Anger, Bargaining, and now in an Acceptance stage after taking up to 31% performance hit on some of services managed by my team. Worst

I've went through Denial, Anger, Bargaining, and now in an Acceptance stage after taking up to 31% performance hit on some of services managed by my team. Worst case has been Elasticsearch so far with our load pattern, taking that 31% hit. Oh well, too bad, enjoying the ride.

bfrog 9y ago
Time to switch to an Epyc host?
- dogma1138 9y ago
  AMD is vulnerable to Spectre and are not fixing variant 2 because it’s “near zero risk”. By near zero risk they mean that no one has yet reversed engineered their branch prediction which is required to effectively exploit it. Give it sometime and the BTI patch would have to be enforced on AMD CPUs also.
- FBISurveillance 9y ago
  We're actually using those new 24-core Epyc hosts for our data science pipeline (HDP/Spark cluster) and they work much better than our previous generation Xeon-based builds. Unfortunately, with those things it takes plenty of time to re-evaluate hardware + in our case we're mostly in the cloud where Skylakes on GCP is the most we can get.
euroclydon 9y ago
What about using dedicated hardware and not running the patches? At attacker has to run malicious code on your server to exploit the vulns anyhow, right?
- jrochkind1 9y ago
  Sure, but I think that would (potentially, with the proper exploit) turn any non-root-level code-execution-able breach of your machine of a machine into a root level one, no? Maybe that's okay?
- FBISurveillance 9y ago
  I usually don't trust people. More than one have we found things improperly secured and/or exposed to the outer internet, or otherwise at risk. We also run black-box software from third party vendors that provide compiled JAR files which is directly related to this fuss. Last thing I'd like to have is another attack vector at home.
starik36 9y ago
How did you measure the performance hit? And what version of Elastic did you test?

bfrog 9y ago

Time to switch to an Epyc host?

dogma1138 9y ago
AMD is vulnerable to Spectre and are not fixing variant 2 because it’s “near zero risk”. By near zero risk they mean that no one has yet reversed engineered their branch prediction which is required to effectively exploit it. Give it sometime and the BTI patch would have to be enforced on AMD CPUs also.
FBISurveillance 9y ago
We're actually using those new 24-core Epyc hosts for our data science pipeline (HDP/Spark cluster) and they work much better than our previous generation Xeon-based builds. Unfortunately, with those things it takes plenty of time to re-evaluate hardware + in our case we're mostly in the cloud where Skylakes on GCP is the most we can get.

euroclydon 9y ago

What about using dedicated hardware and not running the patches? At attacker has to run malicious code on your server to exploit the vulns anyhow, right?

jrochkind1 9y ago
Sure, but I think that would (potentially, with the proper exploit) turn any non-root-level code-execution-able breach of your machine of a machine into a root level one, no? Maybe that's okay?
FBISurveillance 9y ago
I usually don't trust people. More than one have we found things improperly secured and/or exposed to the outer internet, or otherwise at risk. We also run black-box software from third party vendors that provide compiled JAR files which is directly related to this fuss. Last thing I'd like to have is another attack vector at home.

starik36 9y ago

How did you measure the performance hit? And what version of Elastic did you test?