4 ms·
Perhaps the problem is lack of integrity or the fact that these scores are misused to evaluate how good/bad a product is leads to inevitable attempts to manipul
by badrabbit 7y ago
Perhaps the problem is lack of integrity or the fact that these scores are misused to evaluate how good/bad a product is leads to inevitable attempts to manipulate the scores with bad-faith?
Is the problem with the score system itself or the political structure of who gets to set the scores and how? If the former then you have a very good point.
- tptacek 7y agoIt's a technical problem more than a moral problem. As you observe, it's helpful to have some kind of risk metric that captures the complexity of actual exposures in real systems. But with CVSS, there's so much context you need about why a vulnerability is scored as it is, you might as well just ditch the score and share the context; without the details about how the score was arrived at, your 8+ might just as well be my 1.0.