3 ms·

I guess it's the de-facto assumption with security vulnerabilities - if the vulnerability exists, there's a decent chance that someone knows about it and is usi

I guess it's the de-facto assumption with security vulnerabilities - if the vulnerability exists, there's a decent chance that someone knows about it and is using it. I'm not sure if there are any stats (retrospectively) about how "decent" that chance is.

0xFFC 10y ago
Isn't this true for almost all projects? I am asking because they formed this sentence in such way that means "this is only true for Linux kernel".
- danielbarla 10y ago
  Definitely would be true for all projects. That said, perhaps with Linux's omnipresence and role, it'd be very high on the target list (thus making it more true here). I didn't really read the sentence that way though - it felt more like a clarification on why the number of vulnerabilities tend towards zero. Known vulnerabilities are few in number, but this doesn't mean it's vulnerability free.
  - 0xFFC 10y ago
    Thank you
  - uola 10y ago
    I wouldn't say "all projects". The statement is based on that they introduce and remove vulnerabilities at a certain rate. A project that introduces less vulnerabilities or finds them faster would be less likely to have privately known vulnerabilities at any given time.
    - danielbarla 10y ago
      Good point. Though without perfect hindsight (or looking at any given time), it's certainly possible that there are entire categories of privately known vulnerabilities which are not even on the public radar. So it's quite possible that the rate at which known vulnerabilities are fixed might be very misleading. I guess they would offer a good base for the discussion nevertheless.
      - uola 10y ago
        Sure, or if you find a way to find certain vulnerabilities quicker. A bug with 5 year life span that you can find in 1 month doesn't require you to find them too frequently and more projects that fixes such bugs in 1 year will also be vulnerable. This is what I would assume someone like the NSA does. They would have calculated a window of where it's most advantageous for them to find a bug and will then spend the resources at that time. Both in terms of bug life time and severity, but also user share.
      - eeZah7Ux 10y ago
        > it's certainly possible that there are entire categories of privately known vulnerabilities which are not even on the public radar This happened many times for both closed on open source projects. Not surprisingly, given how much is paid for a 0-day.
- noselasd 10y ago
  I didn't interpret it that way at all. It's an article about flaws in the linux kernel, so it's quite natural the sentence was formed the way it was - without meaning to imply that it is true only for Linux.

0xFFC 10y ago

Isn't this true for almost all projects? I am asking because they formed this sentence in such way that means "this is only true for Linux kernel".

danielbarla 10y ago
Definitely would be true for all projects. That said, perhaps with Linux's omnipresence and role, it'd be very high on the target list (thus making it more true here). I didn't really read the sentence that way though - it felt more like a clarification on why the number of vulnerabilities tend towards zero. Known vulnerabilities are few in number, but this doesn't mean it's vulnerability free.
- 0xFFC 10y ago
  Thank you
- uola 10y ago
  I wouldn't say "all projects". The statement is based on that they introduce and remove vulnerabilities at a certain rate. A project that introduces less vulnerabilities or finds them faster would be less likely to have privately known vulnerabilities at any given time.
  - danielbarla 10y ago
    Good point. Though without perfect hindsight (or looking at any given time), it's certainly possible that there are entire categories of privately known vulnerabilities which are not even on the public radar. So it's quite possible that the rate at which known vulnerabilities are fixed might be very misleading. I guess they would offer a good base for the discussion nevertheless.
    - uola 10y ago
      Sure, or if you find a way to find certain vulnerabilities quicker. A bug with 5 year life span that you can find in 1 month doesn't require you to find them too frequently and more projects that fixes such bugs in 1 year will also be vulnerable. This is what I would assume someone like the NSA does. They would have calculated a window of where it's most advantageous for them to find a bug and will then spend the resources at that time. Both in terms of bug life time and severity, but also user share.
    - eeZah7Ux 10y ago
      > it's certainly possible that there are entire categories of privately known vulnerabilities which are not even on the public radar This happened many times for both closed on open source projects. Not surprisingly, given how much is paid for a 0-day.
noselasd 10y ago
I didn't interpret it that way at all. It's an article about flaws in the linux kernel, so it's quite natural the sentence was formed the way it was - without meaning to imply that it is true only for Linux.