Hacker News new | past | comments | ask | show | jobs | submit login

Did you follow yesterday's news? The ME is remotely vulnerable, has full control over the machine, and it's not even clear that it can be upgraded in a secure way.

Why wouldn't you be interested in turning it off?

And why would you classify people who'd rather not be running remotely vulnerable code they can't control as "privacy folks"?




> The ME is remotely vulnerable,

Could you please post a link on that? I read about the AMT bugs, which require the user to manually provision it.


http://cve.circl.lu/cve/CVE-2017-5712

Summary: Buffer overflow in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x/9.x/10.x/11.0/11.5/11.6/11.7/11.10/11.20 allows attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege

EDIT: I'm not sure this was the one the GP referring to



I did follow the news about being remotely vulnerable. That's why I said I'd understand the urge to remove the networking stacks. Other vulnerabilities would require local access.

> Why wouldn't you be interested in turning it off?

I'm not asking why you'd be interested in it, I'm asking why you'd freak out so much about it given X/Y/Z are already true and you can't do anything about them. There's a bit more nuance in my argument than you're giving me credit for here.

> And why would you classify people who'd rather not be running remotely vulnerable code they can't control as "privacy folks"?

I already excluded the part about remote vulnerability. See first point above.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: