ARP
PMV Adaptive Risk Parity ETF
stock NYSE ETF

In some ways, it's a hope and a prayer hoping there won't be any escapes. OpenBSD's VMM has seemed to have less publicly known escape vulnerabilities, if any. That's not to say that they aren't there waiting to be found, but I also feel that OpenBSD's simplicity and model has made something more secure than Linux/KVM. Of course it's hard to know for sure without spending the same amount of hours attacking OpenBSD as has been done on Linux.
Since VM escape is a kernel and hardware level issue, there's nothing I can do other than work on kernel development which isn't something I have time for right now. The people working on that seem very competent and the best I can do for now is test for stability.
There's a lot of other areas that I have more control over for preventing access. I think a large control panel system like VirtFusion has more holes than the VM kernel/hardware layer does, and I don't have that.
I don't think my processors support SEV-ES. They might support SEV but I have not looked into it yet.
I haven't been itching to try it because there's always a huge burden of trust with VPS hosting already. I would recommend anyone moderately paranoid do encrypted rootfs (which you can do because there's serial console access) and anyone with something particularly serious should put it on dedicated hardware. That's not to say that you can't improve on the current model, and maybe SEV does, but I've seen very little as far as escapes go in many years, other than say Januscape, and a lot more on surrounding issues (like making sure VM disks are clean and don't have old customer info or avoiding ARP spoofing or the like.)

In some ways, it's a hope and a prayer hoping there won't be any escapes. OpenBSD's VMM has seemed to have less publicly known escape vulnerabilities, if any. That's not to say that they aren't there waiting to be found, but I also feel that OpenBSD's simplicity and model has made something more secure than Linux/KVM. Of course it's hard to know for sure without spending the same amount of hours attacking OpenBSD as has been done on Linux.
Since VM escape is a kernel and hardware level issue, there's nothing I can do other than work on kernel development which isn't something I have time for right now. The people working on that seem very competent and the best I can do for now is test for stability.
There's a lot of other areas that I have more control over for preventing access. I think a large control panel system like VirtFusion has more holes than the VM kernel/hardware layer does, and I don't have that.
I don't think my processors support SEV-ES. They might support SEV but I have not looked into it yet.
I haven't been itching to try it because there's always a huge burden of trust with VPS hosting already. I would recommend anyone moderately paranoid do encrypted rootfs (which you can do because there's serial console access) and anyone with something particularly serious should put it on dedicated hardware. That's not to say that you can't improve on the current model, and maybe SEV does, but I've seen very little as far as escapes go in many years, other than say Januscape, and a lot more on surrounding issues (like making sure VM disks are clean and don't have old customer info or avoiding ARP spoofing or the like.)