2 ms·

Do they really need to apply all mitigation patches if they only execute their own code on machines running S3 and other managed services? (For EC2/... of cours

• msbarnett 7y ago
  Do you run everything on the machines you only execute your own code on as root? Most people don’t. It’s a defence in depth thing — if someone hits an exploit in a service you want it to be running the lowest privileged user it can get away with so that it can’t rapidly pull all the data out of other subsystems, roam out into the local network and dump DBs, etc. With these vulnerabilities unpatched, an attacker running code as the low privilege user account can sniff credentials for other accounts on the machine, or underlying host, private keys that authenticate against this machine and therefore probably others in the network, etc. I’d say it increases risk quite a bit.