Re: [cfarm-users] OT: Spectre and Meltdown cpu bugs

[Paul Hargrove via cfarm-users]

We all login to the CFarm system using ssh keys.
IF you use agent forwarding AND a key trusted elsewhere, you could be a
target of ssh-agent hijacking.

-Paul

On Sat, Jan 6, 2018 at 2:30 AM, Stas Boukarev via cfarm-users <
cfarm-users@lists.tetaneutral.net> wrote:

> Do people really process sensitive data on the compiler farm?
>
>
> On Sat, Jan 6, 2018 at 5:21 AM Jeffrey Walton via cfarm-users <
> cfarm-users@lists.tetaneutral.net> wrote:
>
>> Hi Everyone,
>>
>> It looks like PoCs are starting to be released for the CPU bugs. Or
>> there's a PoC in the wild for ARM processors. The farm may want to
>> accelerate deployment of the fixes if it has not done so.
>>
>> Early reports:
>> * https://amp.reddit.com/r/sysadmin/comments/7nl8r0/intel_bug_incoming/
>> * https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
>>
>> Latest news:
>> * https://www.theverge.com/2018/1/4/16848976/how-to-protect-
>> windows-pc-meltdown-security-flaw
>>
>> Jeff
>> ___
>> cfarm-users mailing list
>> cfarm-users@lists.tetaneutral.net
>> https://lists.tetaneutral.net/listinfo/cfarm-users
>>
>
> ___
> cfarm-users mailing list
> cfarm-users@lists.tetaneutral.net
> https://lists.tetaneutral.net/listinfo/cfarm-users
>
>


-- 
Paul H. Hargrove 
Computer Languages & Systems Software (CLaSS) Group
Computer Science Department
Lawrence Berkeley National Laboratory
___
cfarm-users mailing list
cfarm-users@lists.tetaneutral.net
https://lists.tetaneutral.net/listinfo/cfarm-users

Re: [cfarm-users] OT: Spectre and Meltdown cpu bugs

[Stas Boukarev via cfarm-users]

Well, don’t do that? You already have to trust the farm admins not to do
that.
I wouldn’t want a compiler farm to slow down because somebody is doing
online banking on it.

On Sat, 6 Jan 2018 at 21:07 Paul Hargrove  wrote:

> We all login to the CFarm system using ssh keys.
> IF you use agent forwarding AND a key trusted elsewhere, you could be a
> target of ssh-agent hijacking.
>
> -Paul
>
> On Sat, Jan 6, 2018 at 2:30 AM, Stas Boukarev via cfarm-users <
> cfarm-users@lists.tetaneutral.net> wrote:
>
>> Do people really process sensitive data on the compiler farm?
>>
>>
>> On Sat, Jan 6, 2018 at 5:21 AM Jeffrey Walton via cfarm-users <
>> cfarm-users@lists.tetaneutral.net> wrote:
>>
>>> Hi Everyone,
>>>
>>> It looks like PoCs are starting to be released for the CPU bugs. Or
>>> there's a PoC in the wild for ARM processors. The farm may want to
>>> accelerate deployment of the fixes if it has not done so.
>>>
>>> Early reports:
>>> * https://amp.reddit.com/r/sysadmin/comments/7nl8r0/intel_bug_incoming/
>>> * https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
>>>
>>> Latest news:
>>> *
>>> https://www.theverge.com/2018/1/4/16848976/how-to-protect-windows-pc-meltdown-security-flaw
>>>
>>> Jeff
>>> ___
>>> cfarm-users mailing list
>>> cfarm-users@lists.tetaneutral.net
>>> https://lists.tetaneutral.net/listinfo/cfarm-users
>>>
>>
>> ___
>> cfarm-users mailing list
>> cfarm-users@lists.tetaneutral.net
>> https://lists.tetaneutral.net/listinfo/cfarm-users
>>
>>
>
>
> --
> Paul H. Hargrove 
> Computer Languages & Systems Software (CLaSS) Group
> Computer Science Department
> Lawrence Berkeley National Laboratory
>
___
cfarm-users mailing list
cfarm-users@lists.tetaneutral.net
https://lists.tetaneutral.net/listinfo/cfarm-users

Re: [cfarm-users] OT: Spectre and Meltdown cpu bugs

[Stas Boukarev via cfarm-users]

Why would  I care. They are already on the server, can already do these
things.

On Sat, 6 Jan 2018 at 19:42 Bart Van Assche  wrote:

> On 01/06/18 02:30, Stas Boukarev via cfarm-users wrote:
> > Do people really process sensitive data on the compiler farm?
>
> Would you like it if a security bug would allow someone to log in under
> your account and abuse your account to perform e.g. a DOS attack or to
> attempt to hack another server?
>
> Bart.
>
___
cfarm-users mailing list
cfarm-users@lists.tetaneutral.net
https://lists.tetaneutral.net/listinfo/cfarm-users

Re: [cfarm-users] OT: Spectre and Meltdown cpu bugs

[Bart Van Assche via cfarm-users]

On 01/06/18 02:30, Stas Boukarev via cfarm-users wrote:

Do people really process sensitive data on the compiler farm?


Would you like it if a security bug would allow someone to log in under 
your account and abuse your account to perform e.g. a DOS attack or to 
attempt to hack another server?


Bart.
___
cfarm-users mailing list
cfarm-users@lists.tetaneutral.net
https://lists.tetaneutral.net/listinfo/cfarm-users

Re: [cfarm-users] OT: Spectre and Meltdown cpu bugs

[Segher Boessenkool via cfarm-users]

On Fri, Jan 05, 2018 at 09:21:23PM -0500, Jeffrey Walton via cfarm-users wrote:
> It looks like PoCs are starting to be released for the CPU bugs. Or
> there's a PoC in the wild for ARM processors. The farm may want to
> accelerate deployment of the fixes if it has not done so.

We'll just do the distro updates, and hopefully that gets us safe enough
fast enough.  Same for everyone, same as always.


Segher
___
cfarm-users mailing list
cfarm-users@lists.tetaneutral.net
https://lists.tetaneutral.net/listinfo/cfarm-users

Re: [cfarm-users] OT: Spectre and Meltdown cpu bugs

[Stas Boukarev via cfarm-users]

Do people really process sensitive data on the compiler farm?

On Sat, Jan 6, 2018 at 5:21 AM Jeffrey Walton via cfarm-users <
cfarm-users@lists.tetaneutral.net> wrote:

> Hi Everyone,
>
> It looks like PoCs are starting to be released for the CPU bugs. Or
> there's a PoC in the wild for ARM processors. The farm may want to
> accelerate deployment of the fixes if it has not done so.
>
> Early reports:
> * https://amp.reddit.com/r/sysadmin/comments/7nl8r0/intel_bug_incoming/
> * https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
>
> Latest news:
> *
> https://www.theverge.com/2018/1/4/16848976/how-to-protect-windows-pc-meltdown-security-flaw
>
> Jeff
> ___
> cfarm-users mailing list
> cfarm-users@lists.tetaneutral.net
> https://lists.tetaneutral.net/listinfo/cfarm-users
>
___
cfarm-users mailing list
cfarm-users@lists.tetaneutral.net
https://lists.tetaneutral.net/listinfo/cfarm-users