[j-nsp] Meltdown and Spectre

[Gert Doering]

Hi,

On Mon, Jan 08, 2018 at 10:13:16AM +0100, Thilo Bangert wrote:
> > Only if said person can execute *arbitrary* code.  Which you can't on my
> > routers, no matter what sort of account I'm giving you.
> You mean like
> 
> $ start shell

This is not arbirary code - no way to do the needed precision timers
in shell.  And JunOS does not let you upload *binaries* (or compile
JavaScript into machine code).

> Fine if you have that disabled. And of course, assuming there a no other 
> bugs in the software stack.

Please try to understand how Meltdown and Spectre work before spreading
FUD.

gert

-- 
now what should I write here...

Gert Doering - Munich, Germany                             gert at greenie.muc.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 630 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/juniper-nsp/attachments/20180108/f5126b25/attachment.sig>