Managing the Linux kernel at AWS: 'A large team of security experts' dealing with fallout from Spectre, Meltdown flaws

At the AWS re:Invent conference last week, The Register asked Chris Schlaeger, director of kernel and operating systems, how the cloud giant protects itself and its customers from speculative execution bugs in Intel CPUs. Schlaeger told us he's responsible "for the lowest layer of the software stack that runs on almost all the …

[Pascal Monett]

Schlaeger is doing the right thing

He his helping the community get the solutions to a very complex problem. Sure, he's doing it because he would prefer not to have to redo the changes for each kernel update, but still, he's trying to help everyone. That is a Good Thing (TM).

The fact remains that hyperthreading is more than 30% of your CPU performance. That's 30% I absolutely cannot do without.

[InsaneGeek]

Re: Schlaeger is doing the right thing

I dont know with the tiny drip flowing out of Amazon and the firehose of opensource into I cant give them a Good Boy button. I think that if it wasn't so painful for them to maintain I'd wager they'd have kept it to themselves as a competitive advantage

[bombastic bob]

Re: Schlaeger is doing the right thing

competitive advantage, yeah.

Some of what the article was talking about includes some "marketing-spin" kinds of info, talking about Nitro and what it does, etc. which is good since it's informative, but you have to expect every spokes-droid for AWS will put a market-spin on things whenever possible.

Still also worthy of mention: if you do not RE-DISTRIBUTE open source software to 3rd parties, you do NOT have to disclose your patches!!!

Just thought I'd mention that...

[bazza]

Re: Schlaeger is doing the right thing

Still also worthy of mention: if you do not RE-DISTRIBUTE open source software to 3rd parties, you do NOT have to disclose your patches!!!

Certainly true for GPL2. I’ve no idea about GPL3...

[Alan_Peery]

Re: Schlaeger is doing the right thing

From the last time I looked at this, the performance increase from hyperthreading is not usually as high as 30%, but I don't have the time to dig up the more detailed refs at this time. It will always be dependent on the details of the loads (and the plural is important) placed on the cores.

But to add some more useful detail to the that general bit above, VMWare 6.7 U2 has some specific techniques that will reduce the impact from the security limits required by the processor bugs that have made hypervisors dangerous: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/performance/scheduler-options-vsphere67u2-perf.pdf

[Bronek Kozicki]

Re: Schlaeger is doing the right thing

Just nitpicking here: not "performance" but "capacity". For low latency trading, where raw power of every single core is paramount, hyperthreading will be typically disabled because it "only" increases capacity at the cost of performance (due to shared caches).

[Claptrap314]

"We take our customer's privacy seriously..."

blah blah blah.

********

If I were in a position to do so, I would seriously consider looking into charging people in this position who make such claims with fraud.

As I've said since this came out: with current architectures, the ONLY way to be safe from this class of bugs is for yours to be the only software running on the system. Of course, if you trust Amazon enough to be running your code in the first place, you're trusting their code as well.

Dedicated servers if you are handing PII, including financial transactions. Then you can get all that performance back without having to worry about these software gyrations. For lower-security stuff, turn on the basic protections & share servers.

[Anonymous Coward]

Re: "We take our customer's privacy seriously..."

Isn't that what they're delivering by modifying the scheduler and hypervisor to ensure that guests never run at the same time on the same on a core pair?

Of course dedicated servers have their place but for the vast majority of compute use, shared platforms offer an attractive price point.

[vulture65537]

Re: "We take our customer's privacy seriously..."

> Dedicated servers if you are handing PII, including financial transactions.

Then there are your passwords, SSH keys, ASLR variables, CSRF variables etc so even if you have no PII you might want to step up the caution.

[IGnatius T Foobar !]

Too much AWS

Too much power and control in one place is not a good thing. Amazon now wields more control over the industry than Microsoft ever did. They need to be taken down a few pegs.

[YourNameHere]

How many attacks?

Question?

How many attacks have been found in the wild that are using these spectre/meltdown bugs?

[It's just me]

Re: How many attacks?

The problem is, with most of these attacks, there is no noticeable effect on the targeted system. So unless the crooks/hackers/TLAs screw up in some other way, you may never know you were attacked, what they got, or how they got it.

[Anonymous Coward]

I get it now

"At our size we have many customers in this situation and it's not financially attractive for us to just turn off hyper-threading."

Money over security. check.

[TeeCee]

Translation:

"There's a known, sound fix for this critical issue and it's easy to apply. However, applying it would cost us a lot of money so we're not going to do it."

[vulture65537]

Re: Translation:

No harm in a few more instance types and let the customer choose?

[amanfromMars 1]

All hail the naked emperor king

"At our size we have many customers in this situation and it's not financially attractive for us to just turn off hyper-threading.

It's not financially attractive for us is the gift and an abiding catastrophic systemic vulnerability that just keeps on giving. Milk it and bilk it to sweet exquisite exhaustion.

[Anonymous Coward]

So much for the shared responsibility model of AWS

https://aws.amazon.com/compliance/shared-responsibility-model/

"AWS responsibility “Security of the Cloud” - AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run AWS Cloud services."

If threat is known and solution also known, what do you do? nothing?