2 ms·
>The article says that even if you turned off the option, Xen and QEMU have a bug which doesn't actually do that. Incompetence on top of incompetence doesn't i
by drzaiusapelord 12y ago
>The article says that even if you turned off the option, Xen and QEMU have a bug which doesn't actually do that.
Incompetence on top of incompetence doesn't invalidate my argument. Minimizing your attack surface should be the norm, unfortunately here on HN it just leads to downvotes.
- rwmj 12y agoRHEL cuts tons of devices compared to upstream qemu. Go and grab the source RPM and see the number of '--disable-XXX' options and the additional patches we add to remove devices. We publish a whitelist of devices we allow [which unfortunately I cannot find now, but it's in the RHEL docs online], and anything else is cut.