Things are a little better now - most vendors have disabled cipher 0, and they're at least starting to pay attention to vulnerabilities (everything I've reporte

Things are a little better now - most vendors have disabled cipher 0, and they're at least starting to pay attention to vulnerabilities (everything I've reported in vendor firmware has been fixed within 6 months or so, which is pretty impressive for groups that gave no fucks about security until recently). As far as the industry goes, with luck we're seeing a transition away from IPMI and to the re-use of more general protocols. Redfish handles many bits of IPMI functionality[1] using standard web technologies rather than reinventing authentication and encryption, so ought to be less bad than hand-rolled crypto. [1] Serial over LAN is probably the biggest missing piece