4 ms·

Let this be the death knell of the "named vulnerability" sensation. Please.

• michaelbuckbee 11y ago
  The naming / marketing of the vulns helps get the word out about the vulnerability. However, it's definitely something that should be reserved for those vulns that affect a larger number of systems severely.
  • namtrac 11y ago
    Not really anymore: http://techcrunch.com/2016/04/11/hyping-vulnerabilities-is-no-longer-helping-application-security-awareness/ http://techcrunch.com/2016/04/11/hyping-vulnerabilities-is-n...
  • geoelectric 11y ago
    I think the value of the name is in making it easy to talk about that particular type of vulnerability as an atomic concept, just like naming everywhere else in computers. I'm not sure there needs to be a bright line on impact for that--if it's impactful enough to talk about, giving it a name makes sense. The hype comes from people not understanding the impact, pure and simple, and overinflating it as it gets passed around. The name just makes it easier to pass around in the process. A good solution would attack the understanding of impact part of it--maybe a severity rating system like we have for tornados, earthquakes, or other catastrophic disasters?--not so much the naming. Making it easy to talk about is great, as long as we make it easy to talk about accurately.
  • CiPHPerCoder 11y ago
    While that can be true, greedy idiots are going to use the hype machine to increase their revenue. I have a vuln I was considering naming, but after BadLock I'm strongly reconsidering it.
    • jra_samba 11y ago
      Well then some good has come of it :-).