61–70 of 149 posts
No one's mentioned this as a potential use case, so wondering if other people have a way to solve a problem I have...we spin up EC2 instances on the fly for running tests, but some of those require a dedicated IP address to deal with a vendor integration. Seems like a dedicated host might solve that, though perhaps not worth the cost. Is there some other way people solve this problem? We currently have an in-house bo…
Can anyone give me the advantages of choosing an EC2 dedicated host over going with a true dedicated server?
> Many of our customers have asked for this feature so that they can run software that is licensed for a particular piece of actual hardware.
So it's more aimed at working with/around archaic licensing schemes, rather than technical advantages.
No one's mentioned this as a potential use case, so wondering if other people have a way to solve a problem I have...we spin up EC2 instances on the fly for running tests, but some of those require a dedicated IP address to deal with a vendor integration. Seems like a dedicated host might solve that, though perhaps not worth the cost. Is there some other way people solve this problem? We currently have an in-house bo…
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-i...
Earlier quoted context omitted.
I'm sure Amazon would love it too (think about how much money they could save / make) but there are a lot of security concerns that need to be addressed. Running code in a virtualized kernel is a lot more secure than running in the real kernel with permissions limited. Theoretically an exploit could allow someone to take over the machine, whereas if the machine is virtualized it's much harder to take over the host.
Doesn't matter if the machine is taken over if its properly contained at the network level. Dedicated server hosting companies have been doing this for years .
Earlier quoted context omitted.
With VMs the customer can share a physical host with others and not have security concerns. This cohosting lets aws pack customers more efficiently and have much better margins for the same quality service. With containers on bare metal, they could not cohost customers.
Uhh, even with containers you really can't cohost in a multi-tenant system. Containerization doesn't securely segregate arbitrary code in the same way traditional virtualization does, and there are still security issues with that. I'm sure AWS is improving on this, as they need to with Lambda and its underlying containerization architecture. But everyone else? Its going to be a while before you can call it "secure".
Earlier quoted context omitted.
Uhh, even with containers you really can't cohost in a multi-tenant system. Containerization doesn't securely segregate arbitrary code in the same way traditional virtualization does, and there are still security issues with that. I'm sure AWS is improving on this, as they need to with Lambda and its underlying containerization architecture. But everyone else? Its going to be a while before you can call it "secure".
It looks like you are in violent agreement
Earlier quoted context omitted.
Unless “the machine is taken over” means firmware-level compromise (e.g. disk controller, NIC controller, …), in which case the next customer allocated to that machine can be compromised despite full disk erase between customers.
I'll agree with this attack vector, although it'd be trivial to have your PXE boot routine between customers re-apply known good firmware to the NIC and disk controller and verify with checksums (unless there's a 0-day out there for the NIC controller, in which case you're owned regardless).
Earlier quoted context omitted.
Doesn't matter if the machine is taken over if its properly contained at the network level. Dedicated server hosting companies have been doing this for years .
Amazon offers billing by the hour for those, meaning they probably move between customers a lot more than traditional dedicated servers. A bare-metal user can do lot of bad things unless you trust your hardware manufacturing 100 %, e.g. by messing with the firmware.
All the advantages of a dedicated server without the hassle of saving tons of money.
Are there any good, dependable, modern alternatives if you don't want to deal with the hardware, and also don't need "scale on demand"? The only name I know is SoftLayer, which is certainly not cheap.