Google's Project Zero team has been working to mitigate the flaws, leading to no downtime and no performance degradation.
Building a slide deck, pitch, or presentation? Here are the big takeaways:
- After months of working on fixes for the Spectre and Meltdown CPU flaws, the Google Cloud team developed solutions with "no perceptible impact" to performance and no downtime.
- If cloud solutions prove to be better protected against flaws like Spactre and Meltdown, it may push some IT leaders to consider further adoption.
Fixes for the recently-disclosed Spectre and Meltdown flaws are causing performance slowdowns and random reboots, but the cloud may be immune to these side effects. According to a Thursday blog post, the Google Cloud team has mitigated the flaws with no customer downtime and no performance degradation.
Software and firmware updates for the flaws have caused all types of problems on physical machines, as reported by TechRepublic's Nick Heath. But cloud providers like Google, Amazon Web Services (AWS), and Microsoft Azure aren't seeing the same impact.
If the work put in by these providers could prove that the cloud is better insulated from such massive flaws, it could encourage adoption of such services by IT leaders who want to avoid headaches in the future. The idea that cloud giants are experiencing less pain from Spectre and Meltdown could also give weight to the argument that public cloud security could, in fact, be stronger than most in-house efforts.
SEE: Cloud computing policy template (Tech Pro Research)
As explained in Google's post, most CPUs have a system in place that walls off applications so they cannot see what's present in the memory of another application. However, the Spectre and Meltdown flaws break down this wall, allowing one app to read another's private memory, potentially exposing sensitive information.
Google noted that hundreds of engineers across the company have been working on mitigations for the flaws for the past few months. They began deploying these solutions in September and October 2017.
"Thanks to extensive performance tuning work, these protections caused no perceptible impact in our cloud and required no customer downtime in part due to Google Cloud Platform's Live Migration technology," the post said. "No GCP customer or internal team has reported any performance degradation."
The second variant of Spectre caused some problems in the beginning, though. According to the post, a new Retpoline kept Google Cloud from having to cut off key performance features and, by December, when all the flaws had been addressed, "nobody noticed," the post said.
These two flaws were "the most challenging and hardest to fix in a decade, requiring changes to many layers of the software stack," the post said. Google also noted that it didn't do it alone, writing that broad industry collaboration was needed to address Spectre and Meltdown. And if the cloud industry continues to stay ahead of such flaws, it could win over many more fans in enterprise IT.
- Special report: The cloud v. data center decision (free PDF) (TechRepublic)
- How much slower will your PC feel after patching for Spectre-Meltdown? (ZDNet)
- Google Cloud Platform: The smart person's guide (TechRepublic)
- Linux vs Meltdown: Ubuntu gets second update after first one fails to boot (ZDNet)
- Meltdown-Spectre patch: Watch out for random reboots warns Intel (TechRepublic)