0

Could any of these be asked on-topic & answerable? I would really like to know more about yet another vulnerability management challenge currently getting buried in the ever growing pile of issues not quite important enough on their own to switch providers over because we got more important things to worry about (until someone publishes a more universally threatening use case).

  • What is AWS referring to when they say they "deployed additional protections"?
  • Is renting out sibling threads to different VPS customers allowing them to read each others memory?
  • Are cloud hosters actually sacrificing SMT performance gains (disabling HT)?
  • Are current side-channel-aware schedulers used in production?
  • How do I test if my rented (Intel-based) virtual machine could leak data via MDS?
  • Which providers offer side-channel-aware virtual machine hosting? (How do I tell?)
  • How do I determine if my hosting provider will be able to live-migrate my virtual machine or if he needs maintenance downtime to apply security patches?

I guess all of these would be closed on both Security.SE and Serverfault, telling me to just ask the respective companies. Been there, done that. Customer support responses so far have been unhelpful enough to make me suspect some companies want to avoid unsettling PR like Googles open admittance "multi-tenant workloads [..] may be vulnerable". I hope to confirm or refute that suspicion, but that would be a quickly outdated answer, too.

I already have a security/cpu related question that failed to attract much interest, and this too likely goes close to the bad/unanswerable/off-topic territory. Maybe I will let this sit on Meta and hope we can together figure out the Question that provides some value.. thank you.

Existing related tags:

1 Answer 1

Reset to default
0

Questions that are answerable by the vendor's documentation or FAQ are off-topic.

Questions about the intention behind an action made by a vendor, when there is not a universally clear reason, would be off-topic (we are not mind readers).

Questions that require inside information from the vendor would be off-topic (opinion-based without the required facts)

Questions asking about which products/services provide X feature is off-topic (open-ended)

Questions about operational needs are off-topic (SuperUser or ServerFault question), even if your intention is to patch (it's not a security question).

Note that on StackExchange, just because it might not be a good question here does not mean that it is not a good question. The background info you provide suggests that you are exploring corner cases of certain vulnerabilities. I'm not sure that a Q&A site is the best place for questions that are speculative by their very nature.

So, basically, it looks like the sample questions you pose would not be a good fit on this Stack. They are questions worthy of exploration, but we are not the best place to ask.

You must log in to answer this question.