Re: Fedora vs. Meltdown & Spectre

2018-01-07 Thread Matthew Miller
On Sun, Jan 07, 2018 at 06:31:43AM -0800, Doug H. wrote: > https://fedoraproject.org/wiki/DNF_system_upgrade > That page is currently showing instructions to upgrade to F27, which > includes the line: > sudo dnf system-upgrade download --refresh --releasever=27 > > So Matthew is noting that people

Re: Fedora vs. Meltdown & Spectre

2018-01-07 Thread Doug H.
On Sat, 2018-01-06 at 10:18 +0100, François Patte wrote: > Le 06/01/2018 à 04:45, Matthew Miller a écrit : > > On Fri, Jan 05, 2018 at 04:07:19PM -0800, Rick Stevens wrote: > > > Yes, and for reference the current release is Fedora 27. Jumping > > > straight to F27 might be risky, so I'd do it in f

Re: Fedora vs. Meltdown & Spectre

2018-01-06 Thread Joe Zeff
On 01/06/2018 01:18 AM, François Patte wrote: Rick Stevens suggest to backup the system: meaning personnal data or the whole system? I would say only your personal data, but others might not agree. ___ users mailing list -- users@lists.fedoraproject.o

Re: Fedora vs. Meltdown & Spectre

2018-01-06 Thread François Patte
Le 06/01/2018 à 04:45, Matthew Miller a écrit : > On Fri, Jan 05, 2018 at 04:07:19PM -0800, Rick Stevens wrote: >> Yes, and for reference the current release is Fedora 27. Jumping >> straight to F27 might be risky, so I'd do it in four steps: > > Note that we _do_ test "n-2" upgrades like this now

Re: Fedora vs. Meltdown & Spectre

2018-01-05 Thread Matthew Miller
On Fri, Jan 05, 2018 at 04:07:19PM -0800, Rick Stevens wrote: > Yes, and for reference the current release is Fedora 27. Jumping > straight to F27 might be risky, so I'd do it in four steps: Note that we _do_ test "n-2" upgrades like this now, so F25 to F27 _should_ work. The transaction test will

Re: Fedora vs. Meltdown & Spectre

2018-01-05 Thread Rick Stevens
On 01/05/2018 02:53 PM, Michael Young wrote: > On Fri, 5 Jan 2018, François Patte wrote: > >> I could not see any kernel update yesterday or today! (f-25) > > And you won't for Fedora 25 which reached its end of life on 12th > December 2017, so there won't be any more updates. I suggest you updat

Re: Fedora vs. Meltdown & Spectre

2018-01-05 Thread Michael Young
On Fri, 5 Jan 2018, François Patte wrote: I could not see any kernel update yesterday or today! (f-25) And you won't for Fedora 25 which reached its end of life on 12th December 2017, so there won't be any more updates. I suggest you update to a later version of Fedora. Michael You

Re: Fedora vs. Meltdown & Spectre

2018-01-05 Thread François Patte
Le 04/01/2018 à 18:01, Matthew Miller a écrit : > On Thu, Jan 04, 2018 at 05:49:15AM -0800, Jonathan Ryshpan wrote: >> What do people know about Fedora vs. the Meltdown and Spectre bugs? > > Mitigation for Meltdown is in place in the kernel updates we released > yesterday. I could not see any k

Re: Fedora vs. Meltdown & Spectre

2018-01-05 Thread Patrick O'Callaghan
On Thu, 2018-01-04 at 17:58 -0600, Michael Cronenworth wrote: > On 01/04/2018 05:32 PM, Patrick O'Callaghan wrote: > > Browsing a malicious website that runs Javascript can be a problem. > > Site isolation is a mitigation technique that provides partial > > protection. Hints for Chrome can be found

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread Michael Cronenworth
On 01/04/2018 05:32 PM, Patrick O'Callaghan wrote: Browsing a malicious website that runs Javascript can be a problem. Site isolation is a mitigation technique that provides partial protection. Hints for Chrome can be found at: https://support.google.com/faqs/answer/7622138 Presumably similar t

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread Patrick O'Callaghan
On Thu, 2018-01-04 at 17:08 -0600, Michael Cronenworth wrote: > On 01/04/2018 04:30 PM, Sergio Belkin wrote: > > But I'm wonder if an attacker can exploit this vulnerability remotely, > > that's > > not clear for me... > > Do you allow remote users in to your systems? If you do not then you

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread Michael Cronenworth
On 01/04/2018 04:30 PM, Sergio Belkin wrote: But I'm wonder if an attacker can exploit this vulnerability remotely, that's not clear for me... Do you allow remote users in to your systems? If you do not then you are not affected. The vulnerabilities require a local user to exploit. Unles

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread Sergio Belkin
2018-01-04 15:27 GMT-03:00 Matthew Miller : > On Thu, Jan 04, 2018 at 12:50:44PM -0500, sean darcy wrote: > > >Mitigation for Meltdown is in place in the kernel updates we released > > >yesterday. (Thanks to kernel team, release engineering, infrastructure > > >/ security, and qa!) Updates for Spe

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread stan
On Thu, 4 Jan 2018 12:50:44 -0500 sean darcy wrote: > Meltdown - CVE-2017-5754 - is not mentioned in the koji kernel builds. > > But should we be worried about Meltdown even without kpti for: > > An internet facing headless laptop acting as a router. No local > users. No X. No browsers. The onl

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread Matthew Miller
On Thu, Jan 04, 2018 at 12:50:44PM -0500, sean darcy wrote: > >Mitigation for Meltdown is in place in the kernel updates we released > >yesterday. (Thanks to kernel team, release engineering, infrastructure > >/ security, and qa!) Updates for Spectre should be coming in soon. > Meltdown - CVE-2017-

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread sean darcy
On 01/04/2018 12:01 PM, Matthew Miller wrote: On Thu, Jan 04, 2018 at 05:49:15AM -0800, Jonathan Ryshpan wrote: What do people know about Fedora vs. the Meltdown and Spectre bugs? Mitigation for Meltdown is in place in the kernel updates we released yesterday. (Thanks to kernel team, release e

Re: Fedora vs. Meltdown & Spectre

2018-01-04 Thread Matthew Miller
On Thu, Jan 04, 2018 at 05:49:15AM -0800, Jonathan Ryshpan wrote: > What do people know about Fedora vs. the Meltdown and Spectre bugs? Mitigation for Meltdown is in place in the kernel updates we released yesterday. (Thanks to kernel team, release engineering, infrastructure / security, and qa!)