4 ms·
Most cloud providers are trying to move up the value chain & provide higher margin differentiated services (managed db, queues, etc) instead of staying at the r
by kasey_junk 7y ago
Most cloud providers are trying to move up the value chain & provide higher margin differentiated services (managed db, queues, etc) instead of staying at the race to the bottom vm market.
These intel mitigations impact those services just like everyone else.
- tln 7y agoDoes it? If customers can't run code on those servers, then these CPU level side channel attacks aren't an issue. This assumes the servers for S3 etc are dedicated to the task.
- TomMarius 7y agoIf I'm offering it as a platform as a service (instead of VM/container as a service) then this adds significant costs. Interesting take: It's better to offer it as a "one click app" aside a basic cloud (docker/kubernetes) platform if you don't want to suck these costs.
- msbarnett 7y ago> Does it? If customers can't run code on those servers, then these CPU level side channel attacks aren't an issue. This assumes the servers for S3 etc are dedicated to the task. I’m not sure that follows. Unpatched, most of these Intel CVEs are almost like unpatched local privilege escalation vulnerabilities. Once you’ve compromised a low privilege process you can sniff your way to more and more powerful credentials on the machine, host, and in the network. Unless higher abstraction cloud service providers are dumb enough to just run everything as root, in which case this doesn’t change anything, they probably can’t (competently) get away with not patching these. Defence in depth matters.