EC2 Dedicated Hosts

Post by teraflop » Tue, Nov 24, 2015, 2:04 AM UTC

toomuchtodo wrote: post #59

paulannesley wrote: post #58

Earlier quoted context omitted.

Unless “the machine is taken over” means firmware-level compromise (e.g. disk controller, NIC controller, …), in which case the next customer allocated to that machine can be compromised despite full disk erase between customers.

I'll agree with this attack vector, although it'd be trivial to have your PXE boot routine between customers re-apply known good firmware to the NIC and disk controller and verify with checksums (unless there's a 0-day out there for the NIC controller, in which case you're owned regardless).

Post by nandhp » Tue, Nov 24, 2015, 2:10 AM UTC

jwrigh13 wrote: post #2

Now how long will it take for Amazon to release a dedicated host marketplace where you can sell unused space on your dedicated hosts?

Post by luhn » Tue, Nov 24, 2015, 2:11 AM UTC

detaro wrote: post #64

toomuchtodo wrote: post #42

Earlier quoted context omitted.

Doesn't matter if the machine is taken over if its properly contained at the network level. Dedicated server hosting companies have been doing this for years .

Amazon offers billing by the hour for those, meaning they probably move between customers a lot more than traditional dedicated servers. A bare-metal user can do lot of bad things unless you trust your hardware manufacturing 100 %, e.g. by messing with the firmware.

Post by duskwuff » Tue, Nov 24, 2015, 2:15 AM UTC

boulos wrote: post #75

Interesting: > each Dedicated Host can accommodate one or more instances of a particular type, all of which must be the same size I'm surprised by the "same size" requirement. It seems like even if you ask customers to stay within a single family (m3, m4, etc.) the customer could do their own hand placement of 8 vCPUs next to a pair of 4s... Edit: Disclaimer, I work on Compute Engine.

Post by dsl » Tue, Nov 24, 2015, 2:16 AM UTC

yid wrote: post #55

andrewstuart2 wrote: post #6

Man, I'd really like to just see bare metal from them. To me that was part of the allure of containers -- so much more efficient than multiple VMs and yet you get a lot of similar benefits, as long as you don't mind some security tradeoffs. Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host.…

> Running ECS is cool and all, and I know they do some container-specific VM optimizations, but I still know I'm running a kernel on a kernel, even if my VMs happen to share a host. The cloud is great for distributed systems, and for these the "kernel on a kernel" cost becomes insignificant with the additional power allowed by the horizontal scalability of letting multiple computers talk over a network (not to mentio…