Network performance regressions from TCP SACK vulnerability fixes (opens in new tab)

(databricks.com)

31 pointsrxin6y ago5 comments

5 comments

The article includes no details on what kernel patch they applied, what kernel version is in their AMI, or if they even have SACK enabled.

Guess you're on your own, Team Databricks!

rxinOP6y ago

We posted more details just now. Will share more next week too.

rxinOP6y ago

More coming next week. We believe we got to the bottom of this last night.

outworlder6y ago

If true, this is unfortunate for anyone who was forced to apply their workaround in their systems, due to them being flagged by some "compliance" tool, even though they are not even accessible externally.

ryacko6y ago

Regressions should be expected, because the unpatched code would have less checks to ensure correct operation.

j / k navigate · click thread line to collapse

5 comments

xyzzy_plugh6y ago

The article includes no details on what kernel patch they applied, what kernel version is in their AMI, or if they even have SACK enabled.

Guess you're on your own, Team Databricks!

rxinOP6y ago

We posted more details just now. Will share more next week too.

rxinOP6y ago

More coming next week. We believe we got to the bottom of this last night.

outworlder6y ago

ryacko6y ago

Regressions should be expected, because the unpatched code would have less checks to ensure correct operation.

j / k navigate · click thread line to collapse