Re: Security (Was: OpenMPI 5.0 to be 32-bit only ?)

[Alastair McKinstry <alastair.mckinstry@sceal.ie>]

Hi,

The push-back from upstream is that they're unconvinced anyone is 
actually using i386 for MPI.

For example, MPI is configured to use PMIx but its thought that doesn't 
work on 32-bit, but no bugs have been reported.

Either we increase our 32-bit testing regime, or realistically consider 
it marginal and dying.

Currently I'm favouring accepting a move to 64-bit OpenMPI as a fait 
accompli as part of code cleanups for 5.X (post Bookworm), and Debian 
moving to MPICH on at least 32-bit archs - I'd favour OpenMPI on 64-bit 
archs for better incoming-code-and-compatability support.

I'd like to hear the case otherwise.


Best regards
Alastair


On 07/02/2023 20:22, Kingsley G. Morse Jr. wrote:
> Hi Alastair,
>
> Thanks for relaying OpenMPI's upstream
> maintainer's interest in our opinions on
> maintaining 32 bit support.
>
> My humble comments are
>
> 1.) 32 bit hardware can be more secure because
>      it's so old it predates back doors known as
>
>          Intel's Management Engine[1] and
>
>          AMD's Platform Secure Processor[2]
>
> 2.) and I'm OK with reporting bugs.
>
> Thanks again,
> Kingsley
>
>
> [1] https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities
>
> [2] https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor#Reported_vulnerabilities
>
>
>
>
> On 02/07/2023 09:54, Alastair McKinstry wrote:
> > Hi
> >
> > I've been pinged by the upstream maintainer of OpenMPI    Jefff Squyres as
> > to our opinions on maintaining 32-bit support.
> >
> > See a  thread here: https://github.com/open-mpi/ompi/pull/11282
> >
> > Until now I've asked for OMPI to hold off going to 64-bit only; saying we
> > can help with the maintenance burden with our testing infrastructure.
> >
> > But we're not well suited to run multi-node test jobs.
> >
> > If 32-bit support is dropped in OMPI we can switch to MPICH as the default
> > on those archs instead, but the core problem remains: how much can we
> > support and test on 32-bit?
> >
> > (Note:  We're at OpenMPI 4.1.4 now for Bookworm; no change planned)
> >
> > Comments please,
> >
> >
> > Alastair McKinstry
> >
> > --
> > Alastair McKinstry,
> > GPG: 82383CE9165B347C787081A2CBE6BB4E5D9AD3A5
> > e: mckinstry@debian.org, im: @sceal.ie:mckinstry
--
Alastair McKinstry,
GPG: 82383CE9165B347C787081A2CBE6BB4E5D9AD3A5
ph: +353 87 6847928 e: alastair@sceal.ie, im: @sceal.ie:mckinstry