Hacker News Reader

Comment by sp332 | Hacker News Reader

I'm not clear what your point was about the VMs. Why do hypervisors need Meltdown mitigated?

I think you're underestimating the % of HPC networks with properly-configured firewalls and only running code from trusted sources.

View on HN

If you trust all the code (and other inputs, or outputs) on all the VMs, and you are running it in a secure environment, you don't. I admit, it's possible I'm underestimating how common this is.

Why you generally do need it is the above isn't true, and microcode has to be loaded at the hypervisor level for everyone or for no one

> it's possible I'm underestimating how common this is

This is quite common in the engineering/research sectors, which love clusters. Think Sandia, oak ridge, etc. I also personally know of several private companies with research clusters. I'm curious how common hpcs are outside of the research community, because honestly I'm struggling to think of a practical need for one.

HPC is quite common in mechanical engineering type industries. Think mechanical stress simulations, wind simulations, that kind of thing. I wouldn't call that part of the research community.

HPC doesn't generally use VMs or Hypervisors.

HPC is not the real use case (target). The percentage of HPC compared to the rest of the target market (public cloud) is insignificantly small.

The real question is do you trust any potential co-tenants in a public cloud that share a hypervisor with you, when said hypervisor does NOT have Spectre/Meltdown fixes applied? (There is only one correct answer...)

Also you can fairly easily mitigate this in a public cloud setting by running your VM on a dedicated hypervisor. AWS calls these "EC2 Dedicated Instances". Interestingly enough for most compute sizes the cost different is negligable. I imagine that isn't the case everywhere / for-everything, but if you A) need pre-Spectre/Meltdown perf and B) need protection against co-tenancy attacks, paying a few more dollars for a dedicated hypervisor host seems like a no-brainer to me.

HPC is the use case in this thread, considering the topic is revolving around HPC benchmarks.

Let me clarify: When it comes to Spectre/Meltdown, HPC users and environments are most likely not prioritized targets of interest. The low hanging fruit in that scenario is stealing cryptographic keys from co-tenants on a public cloud.

Indeed, and generally HPC doesn't use hypervisors anyways.

Reply on news.ycombinator.com