From: "dpreed@deepplum.com" <dpreed@deepplum.com>
To: "Joel Wirāmu Pauling" <joel@aenertia.net>
Cc: "Dave Taht" <dave.taht@gmail.com>,
"Jonathan Morton" <chromatix99@gmail.com>,
cerowrt-devel@lists.bufferbloat.net
Subject: Re: [Cerowrt-devel] KASLR: Do we have to worry about other arches than x86?
Date: Thu, 4 Jan 2018 17:02:56 -0500 (EST) [thread overview]
Message-ID: <1515103376.00366530@apps.rackspace.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2261 bytes --]
Containers and kernel namespaces, and so forth are MEANINGLESS against the Meltdown and Sceptre problems. It's a hardware bug that lets any userspace process access anything the kernel can address.
-----Original Message-----
From: "Joel Wirāmu Pauling" <joel@aenertia.net>
Sent: Thursday, January 4, 2018 4:52pm
To: "Dave Taht" <dave.taht@gmail.com>
Cc: "Jonathan Morton" <chromatix99@gmail.com>, cerowrt-devel@lists.bufferbloat.net
Subject: Re: [Cerowrt-devel] KASLR: Do we have to worry about other arches than x86?
Well as I've argued before Lede ideally should be using to Kernel Namespaces (poor mans containers) for at a minimum the firewall and per-interface routing instances.
The stuff I am running at home is mostly on cheap Atom board, so it's a matter of squeezing out unneeded cruft on the platform. Also I don't want to be admining centos/rhel servers at home.
On 5 January 2018 at 10:47, Dave Taht <[ dave.taht@gmail.com ]( mailto:dave.taht@gmail.com )> wrote:
On Thu, Jan 4, 2018 at 1:44 PM, Joel Wirāmu Pauling <[ joel@aenertia.net ]( mailto:joel@aenertia.net )> wrote:
>
>
> On 5 January 2018 at 01:09, Jonathan Morton <[ chromatix99@gmail.com ]( mailto:chromatix99@gmail.com )> wrote:
>>
>>
>>
>> I don't think we need to worry about it too much in a router context.
>> Virtual server folks, OTOH...
>>
>> - Jonathan Morton
>>
> Disagree - The Router is pretty much synonymous with NFV
>
> ; I run my lede instances at home on hypervisors - and this is definitely
> the norm in Datacentres now. We need to work through this quite carefully.
Yes, the NFV case is serious and what I concluded we had most to worry
about - before starting to worry about the lower end router chips
themselves. But I wasn't aware that people were actually trying to run
lede in that, I'd kind of expected
a more server-like distro to be used there. Why lede in a NFV? Ease of
configuration? Reduced attack surface? (hah)
The only x86 chip I use (aside from simulations) is the AMD one in the
apu2, which I don't know enough about as per speculation...
--
Dave Täht
CEO, TekLibre, LLC
[ http://www.teklibre.com ]( http://www.teklibre.com )
Tel: 1-669-226-2619
[-- Attachment #2: Type: text/html, Size: 3547 bytes --]
next reply other threads:[~2018-01-04 22:02 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-04 22:02 dpreed [this message]
2018-01-04 22:04 ` Dave Taht
2018-01-04 22:12 ` dpreed
-- strict thread matches above, loose matches on Subject: below --
2018-01-04 22:02 dpreed
2018-01-01 23:08 Dave Taht
[not found] ` <CAJq5cE23bbiPE0a_9zd1VLnO7=c7bjmwwxVwaD2=to3fg5TOjA@mail.gmail.com>
2018-01-01 23:27 ` Jonathan Morton
2018-01-02 19:06 ` Jonathan Morton
2018-01-04 12:09 ` Jonathan Morton
2018-01-04 13:38 ` Dave Taht
2018-01-04 13:48 ` Jonathan Morton
2018-01-04 13:59 ` Dave Taht
2018-01-04 14:49 ` Jonathan Morton
2018-01-04 14:53 ` Dave Taht
2018-01-04 20:28 ` dpreed
2018-01-04 21:20 ` Jonathan Morton
2018-01-04 21:40 ` Dave Taht
2018-01-04 21:51 ` valdis.kletnieks
2018-01-04 21:44 ` Joel Wirāmu Pauling
2018-01-04 21:47 ` Dave Taht
2018-01-04 21:52 ` Joel Wirāmu Pauling
2018-01-04 21:54 ` Dave Taht
2018-01-04 21:57 ` Joel Wirāmu Pauling
[not found] ` <1515103187.670416570@apps.rackspace.com>
2018-01-04 22:02 ` Joel Wirāmu Pauling
[not found] ` <1515103048.715224709@apps.rackspace.com>
2018-01-04 22:00 ` Joel Wirāmu Pauling
2018-01-04 22:09 ` dpreed
2018-01-04 22:13 ` Joel Wirāmu Pauling
2018-01-04 22:15 ` Dave Taht
2018-01-04 22:26 ` Jonathan Morton
2018-01-04 22:35 ` Joel Wirāmu Pauling
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.bufferbloat.net/postorius/lists/cerowrt-devel.lists.bufferbloat.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1515103376.00366530@apps.rackspace.com \
--to=dpreed@deepplum.com \
--cc=cerowrt-devel@lists.bufferbloat.net \
--cc=chromatix99@gmail.com \
--cc=dave.taht@gmail.com \
--cc=joel@aenertia.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox