What to do about CVE numbers

Posted Oct 4, 2019 16:13 UTC (Fri) by clugstj (subscriber, #4020)
Parent article: What to do about CVE numbers

I would have to disagree with this statement: "There are, he said, 2.5 billion instances of Linux running on Android phones; that is where Linux runs now. All other users are a drop in the bucket in comparison. So this is where security matters the most".

Volume does not automatically translate to importance. Nefarious actor can crash one million phones, or he can melt down one nuclear power plant. Which is more important?

What to do about CVE numbers

Posted Oct 4, 2019 22:09 UTC (Fri) by khim (subscriber, #9252) [Link] (2 responses)

I sincerely hope makers of nuclear power plants learned not to trust Linux kernel.

And phones carry A LOT OF sensitive information of various sort.

What to do about CVE numbers

Posted Oct 5, 2019 1:46 UTC (Sat) by mathstuf (subscriber, #69389) [Link]

Employees of those sites carry phones for one…

What to do about CVE numbers

Posted Oct 5, 2019 3:25 UTC (Sat) by flussence (guest, #85566) [Link]

In practice, it seems nuclear facilities prefer to use unpatched Windows XP, much like hospitals and the like.

What to do about CVE numbers

Posted Oct 4, 2019 22:43 UTC (Fri) by jamesmorris (subscriber, #82698) [Link] (2 responses)

There are also many many things which are not android phones running Linux: cars, televisions, light bulbs, hard drives etc. Billions surely?

What to do about CVE numbers

Posted Oct 7, 2019 9:20 UTC (Mon) by pomac (subscriber, #94901) [Link] (1 responses)

Connected directly to the internet? I think not.

What to do about CVE numbers

Posted Oct 7, 2019 11:25 UTC (Mon) by jem (subscriber, #24231) [Link]

When a consumer brings home a smart TV and connects it to the home network, why wouldn't it be connected directly to the internet?

What to do about CVE numbers

Posted Oct 7, 2019 9:19 UTC (Mon) by pomac (subscriber, #94901) [Link]

The major difference is: 2.5 billion devices connected to the internet.

If you connect the most important control machine for a nuclear power plant to the internet without firewalls... well.. you'll end up as vapor.