>What do you mean by this? ... Configuration management is not a solved problem. I have extensive experience with Puppet and Ansible and used to manage a fleet

>What do you mean by this? ... Configuration management is not a solved problem. I have extensive experience with Puppet and Ansible and used to manage a fleet of thousands. and I can say frankly they suck. >Livepatching has been a thing on Linux for close to a decade now Yet nobody does it because the option isn't there. To get livepatching on Ubuntu you've got to go via Canonical and pay for their livepatching suite. >mitigating CPU flaws What I actually meant by this is that the design of the kernels we have rely too much on processes theoretically being isolated, even though we now know they aren't. Spectre, Meltdown, Rowhammer, and so on completely break the foundations of every kernel. How can we trust that our browser isn't going to read our disk encryption password from memory? We can't. We built everything with the assumption that can't happen.