New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Location is AMS, would've liked geolocation to show that (helps with what I will host on the machine), machine is very snappy!
We hope you enjoy the server!
Thank you for all the users who signed up,
We are almost out of stock in Amsterdam, Please bare with us as we might have to disable orders in Amsterdam to restock.
How quickly does a VPS activate?
Our automated installer is currently down, I would say within the next 6-8 hours.
Imho the included traffic is too low
it`s cn2 or 4837?
I test it best working from China.
4837 Premium
I cant register on your website. Whether I have VPN on or off, it consistently identifies me as a bot
I would recommend disabling any extensions that block javascript.
I missed it—when is the next sale?
On the Chinese version of LET they have a deal that lasts through the end of July
Tis would be correcto.
It looks like good value for money.
Do you think you (or someone else with this plan) could paste the output of
lscpu?I don't have a plan with them yet (I'm also considering), but I found this (for LAX VPS) if it helps:
✘ VT-x/AMD-V
✔ AES-NI
✔ AVX2
✔ BMI1
✔ BMI2
✘ EPT/NPT
Also:
That's factually incorrect (and I say that as someone whose day job is infosec). In fact, passthrough improves security (SMEP, SMAP, UMIP, etc.). Passthrough, with few exceptions, doesn't actually disable features, it just stops advertising them. The guest can just override most of what the host tries to "disable". This is because most instructions do not support trapping to trigger a #vmexit, only a few critical ones. Disable the CLFLUSH feature in the HV, for example, and nothing happens except it's no longer advertised, but you can still use it for things like FLUSH+RELOAD side-channel attacks.
Unless they mean disabling nested virtualization (EPT and friends), which you can do without disabling passthrough...
More info: https://lowendtalk.com/discussion/218882/re-enabling-aes-ni-on-vpses-that-dont-pass-the-feature-through/p1
It was about CPU passthrough
That quote was from their forum rep. That person's been pretty candid about not being a tech expert. If you were to open a ticket you may get a different response
I don't have an account with them.
@gatewaysentryllc If you'd like, I can explain in more detail what the limitations of CPU passthrough are and how it actually improves security for the guest itself, neighboring guests, and the host. I can also give some QEMU hardening advice for disabling features that do have a negative security impact but which most people don't recognize.
Please may we have a non homo captcha n sign-up, this one wont even allow me to complete on my actual ISP internet.
Yes.
Ouch, yeah a lot of important features used for security are missing like smep, smap, umip, pcid, invpcid, rdrand, rdseed, ibrs, ibpb, stibp, pclmulqdq, sha_ni, pku, ospke, gfni... Some of which, when missing, allow guests to attack each other.
I won't be renewing it either way, had some other issues regarding my usecase (they were resolved)
The setup of "QEMU CPU" isn't based off just a simple reason of security, one of the most major points of this is having the ability to migrate servers from location to location without instruction compatibility issues , by us exposing a common-denominator CPU model, every host in the cluster looks identical to the guest, so VMs can move freely between machines of different generations as we use different CPU's per location.
9950x, 9960x, 9970x, 9980x, 9275F and our latest being added to the cluster the 4565P.
The design of our network is for users to be able to send services (migration between datacenters that have different CPU's) and have the highest availability even during hardware failure, being able to pull from our replication service within 10 minutes> depending on disk size and amount of users required to migrate.
Yep that is a use, but you have it configured not to the least common denominator, but to qemu64. Surely every single device you own has SMEP, for example, but it's not exposed which severely reduces guest security. Instead you should set it to whatever your base, lowest model is, which surely has RDRAND, SMEP, PCID, etc. I assume you don't have any pre-Sandy Bridge CPUs, right?
Haha yes we do not have anything pre sandy bridge,
I will forward this to our OPs team and see what they say.
These are the available models:
As long as you enable the most recent model in this list compatible with your oldest CPU, it should be fine.