Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

xca-attacks.github.io

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#21

Post by nullpoint420 »

wmf wrote: post #20
tardedmeme wrote: post #18

Earlier quoted context omitted.

It's actually several times cheaper to rent a whole physical machine than to rent a single Amazon VM of equivalent compute power.

Unless you want that whole machine to support IAM/VPC/EBS/etc and have proximity to your other VMs.

Yeah I mean sunk cost fallacy, right? If you’ve already hit critical mass in AWS of course you’re going continue investing in it.

If I were to be CTO of a brand new company today, I’d probably just colocate my own servers with K8S. Much cheaper and much lower latency. 2x 1TB RAM servers with 3x 8TB high speed U.2/U.3 drives each would last years.

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#22

Post by oakwhiz »

nine_k wrote: post #2

I wonder how much more expensive it is to rent the whole physical machine at all times for confidential computing purposes, compared to the losses incurred by a breach.

With sufficiently defined lease contracts it should be possible to price out the used machine risk from a new machine... Hmm

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#24

Post by edelbitter »

nvme0n1p1 wrote: post #12
negura wrote: post #11

Earlier quoted context omitted.

but is it possible to verify that the cloud provider has applied the update?

/proc/cpuinfo shows the current microcode version

/proc/cpuinfo shows whatever the hypervisor said, often simply "microcode : 0x1000065"

https://github.com/torvalds/linux/commit/518e7b94817abed94be... https://github.com/qemu/qemu/blob/ac6721b88df944ade0048822b2...

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#25

Post by nine_k »

nullpoint420 wrote: post #21
wmf wrote: post #20

Earlier quoted context omitted.

Unless you want that whole machine to support IAM/VPC/EBS/etc and have proximity to your other VMs.

Yeah I mean sunk cost fallacy, right? If you’ve already hit critical mass in AWS of course you’re going continue investing in it. If I were to be CTO of a brand new company today, I’d probably just colocate my own servers with K8S. Much cheaper and much lower latency. 2x 1TB RAM servers with 3x 8TB high speed U.2/U.3 drives each would last years.

What is your plan when one of the machines needs to be taken offline for repairs? The probability is low, but the downside may be large.

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#26

Post by throawayonthe »

nine_k wrote: post #25
nullpoint420 wrote: post #21

Earlier quoted context omitted.

Yeah I mean sunk cost fallacy, right? If you’ve already hit critical mass in AWS of course you’re going continue investing in it. If I were to be CTO of a brand new company today, I’d probably just colocate my own servers with K8S. Much cheaper and much lower latency. 2x 1TB RAM servers with 3x 8TB high speed U.2/U.3 drives each would last years.

What is your plan when one of the machines needs to be taken offline for repairs? The probability is low, but the downside may be large.

have three of them

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#27

Post by tardedmeme »

nine_k wrote: post #25
nullpoint420 wrote: post #21

Earlier quoted context omitted.

Yeah I mean sunk cost fallacy, right? If you’ve already hit critical mass in AWS of course you’re going continue investing in it. If I were to be CTO of a brand new company today, I’d probably just colocate my own servers with K8S. Much cheaper and much lower latency. 2x 1TB RAM servers with 3x 8TB high speed U.2/U.3 drives each would last years.

What is your plan when one of the machines needs to be taken offline for repairs? The probability is low, but the downside may be large.

How would you do that on AWS? They can shut down your VM due to hardware failures on the host. The probability is low, but the impact may be large.

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#28

Post by nine_k »

tardedmeme wrote: post #27
nine_k wrote: post #25

Earlier quoted context omitted.

What is your plan when one of the machines needs to be taken offline for repairs? The probability is low, but the downside may be large.

How would you do that on AWS? They can shut down your VM due to hardware failures on the host. The probability is low, but the impact may be large.

(1) They will usually notify a few minutes (or hours) in advance, and (2) it would take a few minutes to spin up and set up a new VM to replace the old, without leaving your terminal.

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#29

Post by nullpoint420 »

nine_k wrote: post #25
nullpoint420 wrote: post #21

Earlier quoted context omitted.

Yeah I mean sunk cost fallacy, right? If you’ve already hit critical mass in AWS of course you’re going continue investing in it. If I were to be CTO of a brand new company today, I’d probably just colocate my own servers with K8S. Much cheaper and much lower latency. 2x 1TB RAM servers with 3x 8TB high speed U.2/U.3 drives each would last years.

What is your plan when one of the machines needs to be taken offline for repairs? The probability is low, but the downside may be large.

Take it down and replace it? Obviously I’d have HA setup between my nodes, with CSI replication.

If budget allowed, I’d even spin up another region with DB failover setup too.

All the same architecture applies, the only difference is it’s done with K8S yaml instead of the CDK

Re: Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP

#30

Post by nullpoint420 »

throawayonthe wrote: post #26
nine_k wrote: post #25

Earlier quoted context omitted.

What is your plan when one of the machines needs to be taken offline for repairs? The probability is low, but the downside may be large.

have three of them

Haha exactly - or 4 if we’re balling
Post reply on HN