3 ms·
It’s so weird to see “CVE” used like this. “AppSec research” or just résumé padding?
by rosndo 4y ago
It’s so weird to see “CVE” used like this. “AppSec research” or just résumé padding?
- matthews2 4y agoThe gamification of CVEs has been a real negative for people that actually have to deal with them.
- randomhodler84 4y agoWhether the CVE is found by someone who reports it, or someone that does not makes no difference to the vulnerability of your systems. Better it be in the light, where it can be fixed, than in the darkness.
- Terry_Roll 4y agoI think having a system which is not insecure by design is better, it doesnt matter then if some poor code makes it into a system, it will be contained be default before it can do any damage.
- rosndo 4y agoCVEs are not found, they are applied for. The resume padding sport has resulted in a flood of nonsensical applications.
- randomhodler84 4y agoThat’s true, CVE is just the classification. I should have used “vulnerability” twice. But that people are finding them and padding resumes doesn’t actually make you less secure, the opposite. At least we can know.
- Fnoord 4y agoThe abbrev vuln = clear & understood. Vuln is 1 > letter than CVE. Both require you to know the meaning, but if required vulnerability can be written out. One could do that once, or explain it once. For example in header or first sentence.
- greggsy 4y agoFor some, it’s not a game, but an opportunity or directive. Would you prefer to to patch or do IR?