3 ms·
They are an accomplishment, you spent time and improved security on something. I am only familiar with CVEs where unless MITRE overrides, it is up to the vendor
by _8j50 4y ago
They are an accomplishment, you spent time and improved security on something. I am only familiar with CVEs where unless MITRE overrides, it is up to the vendor to issue a CVE.
Vuln IDs to researchers are what git merged PRs are to devs. It is "creds" but the amount of reputation depends on the amount of work you did. So finding a minor DoS on a little used app isn't the samr as logstash. This is an important incentive because they could have silently sold it to zerodium or on raid/xss using an alias. Bug bounties are better imo but a vuln id is a resume item at least. Having creds and bragging about them are different things imo.
- akerl_ 4y agoIf the expectation is that you get "cred" based on how much work went into a merged PR or a vuln ID, it doesn't sound like vuln IDs or merged PRs are cred at all. Unless whenever I talk to somebody I'm expected to read through all their recent vulns/PRs to calculate how much cred they've earned based on the contents?
- _8j50 4y agoYeah, you should knoe based on the description. Not the amount neccesarily but the value. If you PR 3 lines that improve performance 10x or find 1 line that causes kernel rce , that's cred no?
- akerl_ 4y agoThe work is the “cred”. Knowing that somebody found a kernel RCE lets me know they’ve done interesting security work in the kernel space. It doesn’t matter whether or not they had a CVE assigned for that work. PRs and CVEs are mechanisms for interacting with work. They’re not status symbols, they’re not “cred”.