3 ms·
(Just curious) is there something about this that lacks substance? Sure, a CVE rated 8.6 vs a CVE 9.8 may or may not be worse than the other, but is there a bet
by cj 5y ago
(Just curious) is there something about this that lacks substance? Sure, a CVE rated 8.6 vs a CVE 9.8 may or may not be worse than the other, but is there a better mechanism to communicate severity other than this, or something like "Medium", "High", "Critical", struggling to see your point.
- tptacek 5y agoI'm exclusively back on my bullshit about CVSS being a debacle, and hoping that if I whine about it enough, people will stop putting CVSS scores in headlines, because they're meaningless. "Critical" does a fine job.
- whoknowswhat11 5y agoI have users forward me critical security alerts all the time - most are not even close to critical. I like the scores - just ask them - what's the score.
- Buttons840 5y ago"Critical" reminds me of the urgency every new feature request receives in the backlog.
- arcticbull 5y agoOr a Windows Update that requires a reboot.
- jolux 5y agoSounds like you have a dysfunctional organization.
- KMag 5y agoWith apologies to Cardinal Richelieu, give me 6 items from the policies of the most functional large organization, and I will find something in them which will hang it. If you don't see dysfunction, you're not looking closely enough. That's not to say all organizations are equivalently dysfunctional or that we shouldn't strive for better. I'm just saying that "dysfunctional" isn't a damning accusation.
- jolux 5y agoAbsolutely, but that doesn’t mean we shouldn’t be trying to resolve problems all the same. Teams not having control over their work is inefficient.
- laurent92 5y agoAh yes, the ACEI scale: ASAP, Critical, Emergency, and In progress. In Progress being the only thing that actually gets done. The rest is conjecture. ASAP will never get done.
- rswail 5y agoAny earlier than "possible" is obviously "impossible".
- OJFord 5y agoBut you don't have to do things 'as soon as' they're 'possible'. It does have meaning.
- magicalhippo 5y agoMy dad used to joke he kept three piles of papers on his desk at work: "urgent", "very urgent" and "no longer urgent".