2 ms·
Filter Linux's list to "scores > 8" to take the sampling bias into account - the only way to observe an AMT vulnerability in the first place is to gain remote s
by saulrh 9y ago
Filter Linux's list to "scores > 8" to take the sampling bias into account - the only way to observe an AMT vulnerability in the first place is to gain remote super-root on a widely-deployed core system that may be a PITA to patch. That takes linux down to 27 for 2017. Of those, only about ten are for the kernel itself rather than for binary drivers for nvidia, broadcom, qualcomm, or htc hardware. About half of the total are marked "android"; given that my understanding is that the android kernel has significant changes I wouldn't be surprised if those are android-only exploits. The intersection leaves a grand total of 6 vulnerabilities that are in the actual linux kernel and comparable in severity to the two AMT compromises we've seen.
> I don't see the tech press not recommended OSX anymore !
I certainly don't rec apple. Never have, though previously for non-security reasons, and unless they do a lot of changing, never will.
- ksk 9y agoSure but as a user of Linux, I don't particularly care why the bugs are present in Linux. My view is if you ship it, you should own it. Assigning blame to Nvidia or whoever can go both ways. They might point the blame back at the interfaces inside Linux for being unclear or less than adequately documented, or whatever. Or they might blame some other aspect. Nobody knows unless you're the person who actually wrote the code or has intimate knowledge specific to the bug. In any case, my point wasn't to compare Linux vs AMT. I'm considering deploying ME/AMT to manage systems inside our office. After all this news having come out, I'm waiting till the dust settles. I have to unfortunately wade through a lot of hype to get to the meat of the issue. So far I haven't seen anything that would dissuade me from deploying ME internally.