Friday Notebook, January 5: How will Meltdown and Spectre affect our corner of the industry?

That’s pretty much the only news this week, but we have some year-end posts to plug and Citrix Summit is next week.

This is our weekly log of everything that’s happened in the EUC, EMM, and desktop virtualization space, collected and co-written by Jack and Gabe.

Meltdown and Spectre news

We’re just a short week into 2018, and already we’re dealing with two huge security issues in the form of Meltdown and Spectre.

You can read official explainers from Google Project Zero or meltdownattack.com or spectreattack.com; AnandTech has a good overview, too. In case you’re too busy fielding phone calls, the very short explanation is that there are flaws in a processor’s ability to pre-execute code that can be exploited to provide user mode processes with access to memory in kernel mode.

And when we say “a processor,” we really mean “just about every single processor in every device you’ve bought this century.” Though Meltdown appears to be limited to Intel chips made in the last ten years, Spectre, which is a similar exploit, but more difficult to use, affects different processors and architectures, from AMD and Intel to ARM and POWER.

Because this problem is a physical hardware problem, there’s nothing that can be done at that level to fix it. All the fixes have to be done at the OS level, where operations that would normally require some direct kernel interaction will now have to take a more circuitous route. By their very nature, these fixes will result in a performance hit, and stats from around the web suggest that, depending on the workload, it could be anywhere from a 5% - 30% reduction in speed.

This is all still fresh, and the exact workloads that will be affected aren’t known well enough to say how this will affect desktop virtualization environments. It also remains to be seen whether or not virtual Windows workloads need to be patched, or if patching the hypervisor is enough. The answer to that is likely irrelevant when it comes to the performance hit, though. Any reduction in performance (or a corresponding increase in resource consumption) is going to negatively affect our virtual environments. This will either be felt by the users in the form of slowdowns, or by IT budgets as they add more compute resources to their VDI environments. (Citrix, in their blog post with advice for customers, anticipates the need to add processing power.)

Of course, VDI workloads amount to a fraction of all the hardware organizations use, so our own IT resources are going to be taxed as we deal with this. Then, when you consider that cloud providers also use the same processors and operate at extreme levels of efficiency, you can see how we may have hit on the topic that defines 2018 just four days in.

Links to security bulletins, including Microsoft, Citrix, VMware, Amazon, and Google are available at meltdownattack.com.

Other news

Citrix Summit is next Monday and Tuesday (January 8–9), and while much of it is technically under NDA, there will certainly be news to talk about, so stay tuned. (Last year’s summit brought news of the Unidesk acquisition, after all).

The joint TeamRGE and GeekOut 365 live webinar is less than two weeks away, running on Wednesday, January 17th. The registration link is now live here, and you can find the list of sessions here.

The “scandal” around Apple throttling some iOS devices has pretty much passed (here’s their apology), but over the last week we heard a few completely incorrect explanations why they do it. Here’s the technical explanation.

The Apple Developer Program is now free for nonprofits, schools and government. (Via TechCrunch.)

Recent blog posts we enjoyed

One new blogger Jack started following this year is security expert Troy Hunt. Of note are his recent 5-part series on fixing data breaches and his testimony to the US Congress, also about breaches.

You may know Rory Monaghan as an app packager extraordinaire, and in his latest blog post, he talks about how, due to the decrease in new Win32 apps under development, an increase in next-generation application management products, and widespread use of automated packaging techniques, the number of jobs for full-time application packagers are dwindling. You shouldn’t push the panic button, though. Even if you are a full-time app packager, he says, the skills you’ve attained “transfer well to the infrastructure side of IT Pro work and your app and OS knowledge will give you an edge over those who may only have that Server, Storage, AD or Network knowledge.”

Our articles

Jack: My favorite articles of 2017 (And why I wrote them) Some background on how articles came to be, my thinking behind them, and why they were interesting.

BrianMadden.com 2017 Zeitgeist. Our most viewed articles; industry acquisitions and changes; and companies we met for the first time.

Jack: 6 Enterprise mobility questions I’m asking in 2018 (And how to answer them). I’ll be watching Windows 10 Modern Management, mobile data breaches, Macs in the enterprise, the future of MDM, and new categories of devices.

Gabe: Citrix, VMware, thin clients, printing, DaaS, and Windows 10: Six things I'm watching in 2018. Predictions are overrated! Here are the expectations I have of Citrix, VMware, thin client vendors, printing vendors, DaaS, and Windows 10 migrations as we begin 2018.

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

-ADS BY GOOGLE

SearchVirtualDesktop

SearchEnterpriseDesktop

SearchServerVirtualization

SearchVMware

Close