4 ms·
> Q: Is this a branded vulnerability? > A: The OpenSSL project has not named or created logos for either CVE. The best way to refer to them is via the CVE name
by blueflow 4y ago
> Q: Is this a branded vulnerability?
> A: The OpenSSL project has not named or created logos for either CVE. The best way to refer to them is via the CVE names to avoid confusion.
I chuckled a bit, but im also sad that we ended up in this situation. The obsession with brands is, to some extent, unhealthy.
- deleted 4y ago[deleted]
- nequo 4y agoIt probably serves them better that they haven't. It'd turn it into a meme like Heartbleed that would not be forgotten for the next decade.
- userbinator 4y agoThis is nowhere near as severe as Heartbleed. That's why it's not considered Critical (and also why it hasn't been given a special name.)
- dom96 4y agoMaybe we should set up a naming system just like for COVID variants
- tptacek 4y agoNo, it's not. Branded vulnerabilities are memorable. CVE numbers aren't.
- ASalazarMX 4y agoIt's not a real critical vulnerability unless it has a marketable name and a its own website. Technical names are boring. While it's cool to talk about heartbleed and people knowing what it was (it even had its own XKCD comic), I fear this marketing trend is detrimental because it's not really aimed at the people who apply the patches/mitigations.
- _jal 4y agoOnly for major problems, and even then it seems iffy. I have trouble remembering which specific issue Meltdown actually refers to a couple years on. Personally, I'm totally fine with CVEs. (And if people to stop acting like QIDs are interchangeable, that would be great, too.)
- tptacek 4y agoYou would have no connection to the underlying vulnerability whatsoever if I just mentioned CVE-2017-5754 to you.
- _jal 4y agoNo, but I can establish context in about 10 seconds, and then it doesn't matter. And you won't remember what WhizzyBadBug refers to in 5 years, you'll have to look it up. It'll only take you 10 seconds or so.
- tptacek 4y agoI don't know. The example you chose was Meltdown. I think most people in the field heard Meltdown and can at least place it into the right bucket, of microarchitectural attacks. But more to the point: Meltdown in the moment was far more useful than a CVE number.
- juliusdavies 4y agoWithout looking: Struts !!!! But not 100% sure I got it right. Update: And I'm completely wrong. :-)
- blueflow 4y agoThe branding does not help the patching, its for self-promotion of security people. Its incentives go into the wrong direction.
- excalibur 4y agoSince they declined to name it, we get to name it for them, right? Let's call it CertHurt.
- mdaniel 4y agoRCE-mail? Hopefully someone can work "Cert" in, but all my attempts broke up the meter of saying it Of course, that's cheating a little since we now know that it's not _automatically_ an RCE
- jabroni_salad 4y agoNCSC is calling it SpookySSL but I think it is just for funsies. https://github.com/NCSC-NL/OpenSSL-2022 https://github.com/NCSC-NL/OpenSSL-2022