[hga]

Recently I've been thinking we need a "Device Driver Linux" distribution which can sit off to the side in systems like this or Xen, and just provide access to devices through careful external channels (although there's things like NFS you might want to use...).

The attack surface will still be huge, but perhaps by such hiding you can make it too hard for an attacker to actually get to it.