3 ms·

Do you actually want this spelled out for you? * CRIT - Wake an engineer up at 3 AM to apply the patch. * HIGH - Apply the patch in the next 24 hours. * MEDI

Do you actually want this spelled out for you? * CRIT - Wake an engineer up at 3 AM to apply the patch. * HIGH - Apply the patch in the next 24 hours. * MEDIUM - Apply the patch in the next week. * LOW - Apply the patch in the next month. I'm making these time frames up, but I'm doing it to illustrate a point: different vulnerabilities have different priority levels. If you consider EVERY VULNERABILITY IN EVERY PACKAGE TO BE AN EMERGENCY then your on-call engineers aren't going to get a lot of sleep, and they'll probably find work somewhere less alarmist. Library maintainers like OpenSSL provide these severity levels to assist you in that prioritization game. If you don't trust them, which might be warranted in some systems, that's fine; you can always read every single CVE for every package yourself (or pay someone to do so).

0xbadcafebee 4y ago
More realistically: * CRIT - The CEO called my boss and asked if we were patched yet, so I will be working 16 hour days until it's patched, even if the vuln can't be exploited * HIGH - My boss told his bosses we have a deadline of other work to meet, so I have until the end of next week * MEDIUM - Put it in the backlog * LOW - We will upgrade or sunset the product before it gets patched
- SoftTalker 4y ago
  Nice that you have a CEO who is has ever heard of OpenSSL much less is monitoring patch advisory notices.
  - 0xbadcafebee 4y ago
    They don't, but sometimes a big vuln makes it into The New York Times or something and they get panicky
    - midasuni 4y ago
      When the json thing came out I think it was late night Thursday on HN. I’d checked and patched our applicable servers on Friday and carried on The panic set in over the weekend as managers decided to issue major panic stations, bronze and silver bridge calls, etc - after it had reached the more general press. Told them to f-off, public facing servers had been automatically patched, most of the rest manually done and triaged.
- deleted 4y ago
  [deleted]

0xbadcafebee 4y ago

More realistically: * CRIT - The CEO called my boss and asked if we were patched yet, so I will be working 16 hour days until it's patched, even if the vuln can't be exploited * HIGH - My boss told his bosses we have a deadline of other work to meet, so I have until the end of next week * MEDIUM - Put it in the backlog * LOW - We will upgrade or sunset the product before it gets patched

SoftTalker 4y ago
Nice that you have a CEO who is has ever heard of OpenSSL much less is monitoring patch advisory notices.
- 0xbadcafebee 4y ago
  They don't, but sometimes a big vuln makes it into The New York Times or something and they get panicky
  - midasuni 4y ago
    When the json thing came out I think it was late night Thursday on HN. I’d checked and patched our applicable servers on Friday and carried on The panic set in over the weekend as managers decided to issue major panic stations, bronze and silver bridge calls, etc - after it had reached the more general press. Told them to f-off, public facing servers had been automatically patched, most of the rest manually done and triaged.
deleted 4y ago
[deleted]