Re: [LUG] github meltdown + spectre patch status

To: list@xxxxxxxxxxxxx

Subject: Re: [LUG] github meltdown + spectre patch status

From: Simon Avery <digdilem@xxxxxxxxx>

Date: Thu, 11 Jan 2018 09:00:02 +0000

Delivered-to: dclug@xxxxxxxxxxxxxxxxxxxxx

Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=dclug.org.uk; s=1507453562; h=Sender:Content-Type:Reply-To:List-Subscribe:List-Help:List-Post:List-Unsubscribe:List-Id:Subject:To:Message-ID:Date:From:References:In-Reply-To:MIME-Version; bh=66WQkC/n1jeeQlx27n8mACH3PAn/kLo4kWL6uRNSRpo=; b=OcfCq90de7NTQztCCMo1nJX1yaAMat9v7S/rRNtA5Y5x6BfHHIIn3qJSQJEi32quv8IIneEolQWzZuGYt+AGA5P/8qh+lgM4sv/w6kbmIFM8NTvBVoH3AKx739CWeyyRkVFWK5Tcva4iRVRwbofl2sTJHgq4jSBE494FErBVo30=;

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=eBia46cZnUqCLN0HvMxvfESGjmjItfu+owH24GH70rs=; b=er608fhYllo+iQq2DRC1fVM1SQch0afWXNSr3u01XlAho/1LtVGwUwbXcgxhdGPcS+ ZcBF+k5DjKshMIapk0a7bkdudIDeS4GApxUwW36XQHqBFC0e9Wo9wv80nlR0MJTfypDt T8oH/hiqoPgakgO5F3sN8vKxkryWxB7jvYX40ZzOwkKVOgPfll6IdyksdaLszgoohNBo OTdwRvXjZPiQ4RvPqf2bAFqrtRTczj7q2JkBoTTOpG03ygeEl998zY3OFknLYFTlAsCL UZbuEI8Z64B0RqchHLCNatmWKZYo4KddMtL3iXoj19ESBpVW/0mJStJhUn9+OxWthMCX n0hQ==

On 10 January 2018 at 22:03, Simon Waters <simon@xxxxxxxxxxxxxx> wrote:

How are you handling it?

I did a short briefing at work today. Where I gave a little background so people can understand more if they need/want to.

But in practice since we track the application of Security updates for all OSes, and Browsers, I donât see I need to do more than business as usual patching for this issue, and a good education opportunity not wasted. The Windows patching and AV update looked messy but thatâs not my problem fortunately.

Us: ~12 linux servers, 6 windows servers and ~80 windows clients.

Debian kernel patches are now available for current and old versions (9/8) through the usual security repo and are being applied normally using unattended-updates - but they do need a reboot to migrate to the new kernel which isn't automatic, so folk need to keep an eye andÂ restart when convenient.

Our windows machines are, like you, being handled by BAU patches using Windows Update / WSUS. I note the AMD rollback this week which caused boot-loops (we do have some AMD CPUs but fortunately the patch got withdrawn before it hit them)Â We haven't had many questions about this from the users, so haven't tried to educate them.