Meltdown and Spectre Vulnerabilities

You may have seen some of the recent media coverage of these two processor vulnerabilities.  Meltdown affects almost all Intel processors  even someone my age can remember.  Spectre affects to varying degress both AMD and Intel processors.

This is potentially a serious issue.  Operating Sytem patches are currently rolling out for the Meltdown issue, although we have not received them yet for CentOS. Sadly the patches cause as-yet-unknown performance degradation on computers. We expect those effects to be fairly minimal for our particular processor load.

The gist of this is that we will be doing some server reboots over the next week or so to protect you against these issues. We have a mix of Intel and AMD servers, and wll be doing the Intel servers first since they are the ones that are genuinely endangered. We will atttempt to do the major server reboots of the underlying hardware during evening hours when possible. We will be sending out notices ahead of any outages that are likely to take more than a few minutes.  I do not expect that there wil be any end-user outages before tomorrow - Jan. 5, 2018. Some of the servers may require multiple downtimes since there will also at some point be firmware updates that need to be done on some of the servers - we're still trying to explore what firmware and BIOS updates may become available from our vendors.

Spectre is a whole different issue and the possibility of protecting against it is considerably less clear.

I apologize for the inconvenience but we take your web security seriously and this is an issue that really does require our attention.