News for hackers. Stuff that matters.
Re:Intel patches new ME vulnerabilities by ec109685 on Sunday July 22, 2018 @11:50AM (#17587301)
Do you have any citations that companies are replacing their intel processors every 2 years? That is not inline with what I have seen.
Re:Intel patches new ME vulnerabilities by ams6110 on Sunday July 22, 2018 @11:58AM (#17587337)
More like 5 years, or even longer, where I work.

We have some 7 year old Dell servers that are still chugging along, performing their duties as well as ever.

Re:Intel patches new ME vulnerabilities by close04 on Sunday July 22, 2018 @12:21PM (#17587489)
Usually the amortization of such systems is ~ 4 years. But many smaller companies choose to stay with the old systems a little longer, 5, or even 6 years lately. Simply because there is no push performance wise.

The main motivation for upgrade is software support (usually for the OS, driven by Microsoft), or failure rates for the older systems.

And that's for the desktop side. For servers they tend to be taken out of commission when the service they provide is migrated to a whole new platform and the legacy one goes to a better place along with the metal. Servers are more reliable than your regular desktops, they get better support, and most companies don't upgrade running systems.

P.S. I don't know of any enterprise environment where ME is used for managing servers. It's usually ILO, ILOM, DRAC, IMM, RMM. I think ME is mostly for desktops or SOHO, Intel has RMM for servers.

Re:Intel patches new ME vulnerabilities by oneplane on Sunday July 22, 2018 @04:37PM (#17588804)
Also, on servers, Intel has (requires?) SPS: server platform services. It's like an ME, but worse, and without a way to neuter it.

Edit: a quick search yields a common core or division at Intel behind the ME and SPS, so that makes a bit of sense. There has been at least 1 exploit in the wild for that SPS, it also lists TXT and ME, so I guess it's a shared (MINIX?) kernel that had the bug.

Re:Intel patches new ME vulnerabilities by forapurpose on Sunday July 22, 2018 @04:42PM (#17588828)
> For servers they tend to be taken out of commission when the service they provide is migrated to a whole new platform

Or when the service contract expires or is too expensive to extend. You can't run a server of any importance without a service contract; it can be the difference between all the server's users and services being down for hours or a more than a week, and between IT management keeping their job for hours or longer.

Re:Intel patches new ME vulnerabilities by mmt on Sunday July 22, 2018 @09:33PM (#17589904)
That's just the "enterprise" hardware model. It's overall extremely expensive to begin with and may have made sense back in the days of proprietary hardware, but makes no sense for a commodity hardware installation beyond a trivial size.

It's hard to imagine not being able to find a replacement in more than a week, especially if one skipped service contract and just bought a spare or two with a fraction of the savings.

It's why moving to cloud infrastructure can be so much cheaper for these shops.

Of course, if it is a trivial size, like a single server at a small business, that's a different story.

Re:Intel patches new ME vulnerabilities by forapurpose on Sunday July 22, 2018 @10:08PM (#17590076)
Yes, somehow I thought the GP was talking about small business, but I see there is nothing in the text that says so (at least not now). Yes, of course, with cloud infrastructure or just virtualization and spare hardware, service contracts have much less value.

> makes no sense for a commodity hardware installation beyond a trivial size

It's not the commodity hardware - x86 servers have been mostly commodity hardware for decades - it's virtualization (or other rapid recovery and migration tech) that makes it work.

Re:Intel patches new ME vulnerabilities by mmt on Monday July 23, 2018 @01:28AM (#17590756)
> Yes, of course, with cloud infrastructure or just virtualization and spare hardware, service contracts have much less value.

My assertion is that service contracts for hardware have zero value for commodity hardware installations (beyond trivial size). To whit, they are, invariably, a scam.

Server hardware fails vanishingly rarely, with specific, notable exceptions of certain components. Those exceptions have predictable [1] failure rates that are therefore straightforward to budget and/or engineer around. Managers don't know to insist on this, so the scam persists.

This was true even before the advent/popularity of virtualization (and therefore "cloud" techniques).

It's also true regardless of whether or not one keeps spares on hand. With commodity hardware, vendors always have plenty of spares.. one just hasn't purchased them in advance, so there's an increased latency (not entirely unlike the spares available under a service contract).

> It's not the commodity hardware - x86 servers have been mostly commodity hardware for decades - it's virtualization (or other rapid recovery and migration tech) that makes it work.

That's where I disagree, at least partly, if I understand correctly the kind of tech you're referring to.

Those software solutions are generally just about convenience, or, ideally, reducing recovery time in the case of a non-redundant architecture. Even then, they might turn hours into minutes, not weeks into minutes.

More importantly, it's not that software that makes this work. It's the commodity hardware (and, arguably, commodity software/firmware hiding within) that makes it work. If a disk fails, any same or larger [1] can be used as a replacement. Same for RAM or even full servers. It doesn't have to be the same brand because that's the point of it being a commodity. That fact completely eliminates any problem of being down for a week due to hardware failure. In a major tech hub city, getting something delivered same day might not even require paying a premium.

Before virtualization or any similar abstraction layer, one could just move disks to a new server (best case) or restore from a backup (worst case).

[1] Other than "black swan" events like the flooding in Thailand that wrecked predictability (and reliability overall) for a generation of HDDs. Even then, if one made assumptions based on warranty length changes, those would have been close enough.

[2] Well, OK, one does have to be careful to meet minimum performance, especially for SSDs, but even a failure there won't kill basic functionality

Re:Intel patches new ME vulnerabilities by brudgers on Sunday July 22, 2018 @12:20PM (#17587477)
Curious if they are managed with ME.
Re:Intel patches new ME vulnerabilities by close04 on Monday July 23, 2018 @03:34AM (#17591111)
They have the ME and Server Platform Services (SPS) on top of that but I doubt anyone uses that to manage when Dells have DRAC/iDRAC.
Re:Intel patches new ME vulnerabilities by samstave on Sunday July 22, 2018 @07:19PM (#17589416)
extrapolate as you will...

https://aws.amazon.com/blogs/aws/ec2-instance-history/

    I didn’t have one, but it seemed like a worthwhile thing to have and so I spent a few minutes putting the following list together (these are all announcement dates):
August 2006 – m1.small.

October 2007 – m1.large, m1.xlarge.

May 2008 – c1.medium, c1.xlarge.

October 2009 – m2.2xlarge, m2.4xlarge.

February 2010 – m2.xlarge.

July 2010 – cc1.4xlarge.

September 2010 – t1.micro.

November 2010 – cg1.4xlarge.

November 2011 – cc2.8xlarge.

March 2012 – m1.medium.

July 2012 – hi1.4xlarge.

October 2012 – m3.xlarge, m3.2xlarge.

December 2012 – hs1.8xlarge.

January 2013 – cr1.8xlarge.

November 2013 – c3.large, c3.xlarge, c3.2xlarge, c3.4xlarge, c3.8xlarge.

November 2013 – g2.2xlarge.

December 2013 – i2.xlarge, i2.2xlarge, i2.4xlarge, i2.8xlarge.

January 2014 – m3.medium, m3.large.

April 2014 – r3.large, r3.xlarge, r3.2xlarge, r3.4xlarge, r3.8xlarge.

July 2014 – t2.micro, t2.small, t2.medium.

January 2015 – c4.large, c4.xlarge, c4.2xlarge, c4.4xlarge, c4.8xlarge.

March 2015 – d2.xlarge, d2.2xlarge, d2.4xlarge, d2.8xlarge.

April 2015 – g2.8xlarge.

June 2015 – t2.large.

June 2015 – m4.large, m4.xlarge, m4.2xlarge, m4.4xlarge, m4.10xlarge.

December 2015 – t2.nano.

May 2016 – x1.32xlarge.

September 2016 – m4.16xlarge.

September 2016 – p2.xlarge, p2.8xlarge, p2.16xlarge. October 2016 – x1.16xlarge.

November 2016 – f1.2xlarge, f1.16xlarge.

November 2016 – r4.large, r4.xlarge, r4.2xlarge, r4.4xlarge, r4.8xlarge, r4.16xlarge.

November 2016 – t2.xlarge, t2.2xlarge.

November 2016 – i3.large, i3.xlarge, i3.2xlarge, i3.4xlarge, i3.8xlarge, i3.16xlarge.

November 2016 – c5.large, c5.xlarge, c5.2xlarge, c5.4xlarge, c5.8xlarge, c5.16xlarge.

July 2017 – g3.4xlarge, g3.8xlarge, g3.16xlarge. September 2017 – x1e.32xlarge.

October 2017 – p3.2xlarge, p3.8xlarge, p3.16xlarge.

November 2017 – x1e.xlarge, x1e.2xlarge, x1e.4xlarge, x1e.8xlarge, x1e.16xlarge.

November 2017 – m5.large, m5.xlarge, m5.2xlarge, m5.4xlarge, m5.12xlarge, m5.24xlarge.

November 2017 – h1.2xlarge, h1.4xlarge, h1.8xlarge, h1.16xlarge.

November 2017 – i3.metal.

June 2018 – m5d.large, m5d.xlarge, m5d.2xlarge, m5d.4xlarge, m5d.12xlarge, m5d.24xlarge.

July 2018 – z1d.large, z1d.xlarge, z1d.2xlarge, z1d.3xlarge, z1d.6xlarge, z1d.12xlarge, z1d.metal, r5.large, r5.xlarge, r5.2xlarge, r5.4xlarge, r5.12xlarge, r5.metal, r5.24xlarge, r5d.large, r5d.xlarge, r5d.2xlarge, r5d.4xlarge, r5d.12xlarge, r5d.24xlarge, r5d.metal.

Re:Intel patches new ME vulnerabilities by mmt on Sunday July 22, 2018 @09:36PM (#17589915)
Unfortunately, announcement dates only give one endpoint of the timeline. The other endpoint, retirement date (from even previous-generation availability), is crucial to any anlysis.
Re:Intel patches new ME vulnerabilities by ec109685 on Tuesday July 24, 2018 @12:58AM (#17598219)
Yeah, exactly. No argument that Intel keeps improving their processors. But at what cycle is the improvement so great, you are throwing money away by not replacing the hardware for the next generation.
Re:Intel patches new ME vulnerabilities by mmt on Tuesday July 24, 2018 @01:38AM (#17598371)
It's also never quite as simple as looking at each generation as a discrete unit of upgradability.

Not only can the price:performance spread vary between generations, but this can change over time, particularly because the model availability within a generation broadens over time.

Add to this the dimension of low power versions of certain processor models (whose selection is therefore strictly a cost/longevity decision, presumably invisible to someone like a cloud end user), one can't safely generalize.

The other problem is that the CPU isn't even, necessarily, the majority of the purchase cost of a server.

Re:Intel patches new ME vulnerabilities by samstave on Tuesday July 24, 2018 @03:13PM (#17604065)
The intention of my post was to look at the announcement dates as possible relation to the roll-out of new CPU capacity within AWS, which may tie into the retirement of older capacity and compute types. If we had that information, then you could answer some of the questions asked surrounding the deprecation schedules of HW in a DC the size of Amazon.

Specifically as it relates to the resources required to provide the same compute power for any given pool of instance capacity.

I know for a first-hand fact that AWS will not reveal its compute capacity, but in conversations with them, when we were actively monitoring the availability and continual use of all spot prices across every region, we had the data, according to them, to infer what their capacities were.

We had the data at the time, but not the interest/need, to be able to surmise ballpark compute capacity across all instance types in the spot pools - which is to say, what AWS' spare (i.e. non-fully reserved/dedicated) capacity was, and what the demand was for it. Additionally - we could have also bee publishing AWS' hourly revenues, dammit - I wish I would have thought of that - as people would have been interested in that data...

Re:Intel patches new ME vulnerabilities by mmt on Tuesday July 24, 2018 @04:49PM (#17604801)
> If we had that information, then you could answer some of the questions asked surrounding the deprecation schedules of HW in a DC the size of Amazon.

But we still don't, so we still can't infer anything at all from the announcement schedule.

Moreover, assuming AWS is growing fast enough, new instance type announcements could be entirely decoupled from deprecations. Even with both sets of data, it may not tell us anything about overall replacement rate, without also knowing the overall growth rate.