6 ms·

"Many customers" meaning people and orgs running server software on direct hardware. Does your caching or database server run user provided code? Is it access

"Many customers" meaning people and orgs running server software on direct hardware. Does your caching or database server run user provided code? Is it accessible to the outside in any way? If not, then maybe it doesn't need the patch.

deleted 8y ago
[deleted]
infinity0 8y ago
The article says "Many computer users" not "Many customers". Furthermore when the article mentions "customers" elsewhere we can probably assume it means "Intel customers" which is a much greater subset than the group you're talking about, and which would be probably less than 1% as numerous as the "Many computer users" that run javascript. lol, javascript
- kbenson 8y ago
  > which would be probably less than 1% as numerous as the "Many computer users" that run javascript. So? Many does not mean most. There's a choice to be made, apply the security patch and accept the performance loss, or don't. Some people may not need to to remain close to as safe as they were previously based on their configuration for some of their systems, and I would guess the number of systems easily numbers in the millions. This is a benefit for those people, and worth mentioning, even if it's not nearly a large a number as the total number of CPUs or customers.
  - infinity0 8y ago
    In this case, many does mean most.
cosmojg 8y ago
https://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf https://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pd...
- kbenson 8y ago
  Are you trying to imply that because somehow ASLR can't protect you and they show and example in the context of Javascript that somehow that means your Postgres server/service is immediately at risk? At least, that's all I can think you are trying to imply, because you didn't actually say anything, you just dropped a link. It's hard to have a useful conversation when that happens.

6 ms·

"Many customers" meaning people and orgs running server software on direct hardware. Does your caching or database server run user provided code? Is it access

by kbenson 8y ago

deleted 8y ago
[deleted]
infinity0 8y ago
The article says "Many computer users" not "Many customers". Furthermore when the article mentions "customers" elsewhere we can probably assume it means "Intel customers" which is a much greater subset than the group you're talking about, and which would be probably less than 1% as numerous as the "Many computer users" that run javascript. lol, javascript
- kbenson 8y ago
  > which would be probably less than 1% as numerous as the "Many computer users" that run javascript. So? Many does not mean most. There's a choice to be made, apply the security patch and accept the performance loss, or don't. Some people may not need to to remain close to as safe as they were previously based on their configuration for some of their systems, and I would guess the number of systems easily numbers in the millions. This is a benefit for those people, and worth mentioning, even if it's not nearly a large a number as the total number of CPUs or customers.
  - infinity0 8y ago
    In this case, many does mean most.
cosmojg 8y ago
https://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf https://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pd...
- kbenson 8y ago
  Are you trying to imply that because somehow ASLR can't protect you and they show and example in the context of Javascript that somehow that means your Postgres server/service is immediately at risk? At least, that's all I can think you are trying to imply, because you didn't actually say anything, you just dropped a link. It's hard to have a useful conversation when that happens.