Hacker News Reader

Comment by insomniacity | Hacker News Reader

Hetzner still haven't said anything to me about Spectre/Meltdown, or rebooted my VPS, so I'm not sure I trust them any more!

View on HN

Prior to this announcement, the announcement about Spectre/Meltdown migration was literally at the very top of their customer homepage. After this announcement, it is the second thing you see when you log in: https://i.imgur.com/XTSTHkR.jpg

I can't think of an approach that would be more direct to their customers than seeing it on top of their customer homepage.

They have written an extensive article about it here: https://wiki.hetzner.de/index.php/Spectre_and_Meltdown/en

In the context of renting one of their VPS this is fair criticism. The information handed out by Hetzner is not adequate regarding their exposure and timeframe for patching. It's been several weeks since the public disclosure, and if they are still vulnerable for meltdown this puts all customers systems at massive risk.

"The host systems will be updated to fix the vulnerabilities as soon as possible. The necessary reboots will be announced on Hetzner Status. You may subscribe to be notified. "

Our Cloud plattform has applied all currently released stable patches. We expect to apply more patches as they are released by our vendors over the new few days and weeks. The existing CX plattform was, has, and will be updated via live migration without any noticeable customer impact --Katie, Marketing, Hetzner Online

That's strange. I remember getting an e-mail from them about it some time ago. Perhaps they had issues e-mailing you. Check your spam folder.

Nope, plenty of email from them. Nothing in spam.

Anyway, the proof is in the 264 day uptime!

IIRC there is something called "Live Migration" which could easily explain why you can see 264 days of uptime even with the hypervisors updating below

You can freeze a VPS, save its state and restore it later without affecting the uptime. The clock would get skewed (system time vs hardware time difference), but unless you have something that detects that you won't even notice it.

Reply on news.ycombinator.com