By now you have probably seen the news about a major flaw in the design of CPUs from all major vendors (Intel, AMD, and ARM) resulting in a series of vulnerabilities in operating systems and … web browsers?
One of my favourite things to do is to make queries run faster. What the Meltdown and Spectre attacks have done is made most computers slower, by as much as 30%, depending on the workload.
So a question you might be asking yourself is: am I going to forgo the security patches (if the option exists) to eke out the most performance on my hardware that I spent a lot of money on?
Not installing the patches:
- Performance stays the same.
- Physical servers not making use of SQLCLR, linked servers, and other untrusted features are not affected.
Installing the patches:
- Workloads will be slower on most CPUs, by as much as 30% in certain circumstances.
- Queries will run slower, and maintenance tasks will take longer, affecting RPO and RTO.
- Your environment will be secure, because isn’t that the point, really?
I won’t lie: it’s tempting to want to stay on the performance side, especially if you’re in an organization that doesn’t want to upgrade to the latest and greatest. This could hurt productivity in more ways than you think.
However, the vast majority of systems are virtualized now, which means we’re all at risk.
Any data in memory on one virtual machine might be exfiltrated by a malicious person using a different virtual machine on the same host. This is the worst possible thing that can happen, because I won’t know about it until my organization is blackmailed, or I read about it on Troy Hunt’s Twitter account.
This is a big deal. Not taking action is foolhardy. In fact, Azure took the unprecedented action of rebooting every single one of their millions of VMs, and I’m sure Amazon and Google did the same thing with their cloud infrastructure.
That said, we should take care when patching, following all of the best practices we’ve learned. And if there’s an antivirus or anti-malware tool on your Windows server, take care that your machine doesn’t blue-screen when you start it back up again.
The reality is that no one knows how bad the performance degradation will be. This is where a baseline becomes extremely useful. Hopefully it remains in the 5% to 7% range.
Patch your servers. Do it carefully, but do it soon. Keep trusted and untrusted processes on different machines. There’s a link to Microsoft’s KB article titled “SQL Server Guidance to protect against speculative execution side-channel vulnerabilities” above, but there’s a lot going on and I want to draw your attention to this quote (my highlighting):
To get all available protections, hardware/firmware and software updates are required.
And this:
Microsoft recommends separating untrusted processes and trusted process onto different physical or virtual machines.
If you have any thoughts, share them with me on Twitter at @bornsql. And please consider purchasing my book.
Photo by Dawn Armfield on Unsplash.