3 ms·
If the expectation is that you get "cred" based on how much work went into a merged PR or a vuln ID, it doesn't sound like vuln IDs or merged PRs are cred at al
by akerl_ 4y ago
If the expectation is that you get "cred" based on how much work went into a merged PR or a vuln ID, it doesn't sound like vuln IDs or merged PRs are cred at all. Unless whenever I talk to somebody I'm expected to read through all their recent vulns/PRs to calculate how much cred they've earned based on the contents?
- _8j50 4y agoYeah, you should knoe based on the description. Not the amount neccesarily but the value. If you PR 3 lines that improve performance 10x or find 1 line that causes kernel rce , that's cred no?
- akerl_ 4y agoThe work is the “cred”. Knowing that somebody found a kernel RCE lets me know they’ve done interesting security work in the kernel space. It doesn’t matter whether or not they had a CVE assigned for that work. PRs and CVEs are mechanisms for interacting with work. They’re not status symbols, they’re not “cred”.