This calls for an LWN article

Posted Jan 10, 2018 13:49 UTC (Wed) by davecb (subscriber, #1574)
Parent article: A look at the handling of Meltdown and Spectre

If many vendors and the larger technical community don't know how Linux handles a controlled disclosure, then an article on it is in order.

This calls for an LWN article

Posted Jan 10, 2018 15:26 UTC (Wed) by AdamW (subscriber, #48457) [Link] (3 responses)

It's not about "Linux", though. It's about the Linux kernel, major Linux distributors, Windows, macOS, microcode from at least four CPU manufacturers delivered both by microcode_ctl and its equivalents on other platforms _and_ by system firmware (which pulls major hardware vendors into the mix), major cloud platforms, and even browser vendors...all of whom were attempting to keep a shared secret and co-ordinate disclosure and remediation of not just one vulnerability, but a family of related vulnerabilities and the general concept behind them, some of which don't really even have any clear and simple fix.

This calls for an LWN article

Posted Jan 10, 2018 15:33 UTC (Wed) by davecb (subscriber, #1574) [Link] (2 responses)

Yes, but *all* those folks should know how the Linux community deals with the common case.

This calls for an LWN article

Posted Jan 18, 2018 13:59 UTC (Thu) by Wol (subscriber, #4433) [Link] (1 responses)

But how many of them have "nothing" to do with the linux community?

In quotes because of course there's some interaction, but why would for example Microsoft concern itself with how Linux handles vulnerabilities?

The problem, as *so* *often* is the case, is that when the needs suddenly scale dramatically, the infrastructure can't respond and scale similarly. No blame to anyone, that's just reality doing what reality does ...

Cheers,
Wol

This calls for an LWN article

Posted Jan 19, 2018 16:02 UTC (Fri) by millenix (guest, #39711) [Link]

Microsoft Azure hosts a whole lot of Linux VMs - they have exactly the same exposure as Amazon Web Services and Google Cloud Engine here.