points by tptacek 16 hours ago | 0 comments
If you're a provider, you absolutely do; it's part of the stack. It's like saying "Ruby" isn't a part of "Rails".
[–] sscaryterry 12 hours ago
[–] tptacek 11 hours ago
You've repeatedly claimed it, but the logic doesn't hold. KVM is a dependency for Firecracker, just like brotli is a dependency for Node. What matters isn't "who's according-to-Hoyle responsible", what matters is "are you exposed to it".
Not for nothing, but it would have been possible for Firecracker to disable the partial checksum feature this vulnerability exploits. If you wanted to push on the argument a bit, you could say that Firecracker ran virtio-net in an aggressive and possibly unsafe configuration. I wouldn't agree, but it's a colorable argument.
Ruby is not Rails. The same way Linux KVM is not Firecracker. You cannot paint everything with the same brush. The author chose to make this sensationalist by implying its a firecracker issue. It is not.
I've repeatedly explained this.