4 ms·

It's a social and economic problem. The NVD and CVE teams are very low staffed, with people who get a large amount of reports every day. There is no way they c

It's a social and economic problem. The NVD and CVE teams are very low staffed, with people who get a large amount of reports every day. There is no way they can process each report as thoroughly as people want them to while reporting the security issues as fast as possible. I can understand the frustration, but there should be some consideration for these facts. The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not. Then there's gaming of the system where products with bugs do not want to be exposed as insecure, so they will try to lower the scores assigned to them. Then there's pentesters who want to get high scoring bugs for bounties and clout, and they will try to raise the scores... All this ends up where the scores mean very little, but it's the best we have. I've seen vulns with a 9+ that are clearly not exploitable, and ones that are 6-7 which are powerful easily exploitable primitives.

bombcar 3y ago
It's the inverse of the "boy crying wolf" - if they mark a vulnerability low and it ends up being the next log4shell, they look really bad and the organization may be effectively over. But if they rank everything "7+" then they have plausible deniability. So everything will be ranked 7-10. Meaning 1-6 are useless.
- rdtsc 3y ago
  That was my thought too. Imagine someone at some desk in some drab office building with a huge pile of these to sort though. Different libraries, languages, frameworks etc. They probably have some quota to fill. How motivated are they going to be find out who the authors are, how to contact them, compose a long message, explaining, asking questions? Nah, just look at the code, google a few things, and assign as high of a score as possible. Nobody needs to have someone come and yell at them for assigning a 3 to the next log4shell.
DannyBee 3y ago
"The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not. " Uh, none of this explains why they re-score the vulnerabilities themselves, ignoring the vendor scores and deciding they know best, when they seem to know ... nothing. Which if you read through the links, you'll see is one of the main complaints, and something they document here: https://nvd.nist.gov/general/FAQ-Sections/CVE-FAQs#faqLink9 https://nvd.nist.gov/general/FAQ-Sections/CVE-FAQs#faqLink9 Their take is basically "we get to do this and if it's wrong it's your problem to get us to correct us". That doesn't make any sense. As my child's kindergarten teacher once asked a student: "Do you think if everyone decided to do that, it would turn out okay?" NVD and CVE teams will simply never have the expertise or time or information necessary to actually re-score these things correctly. You'll also note that despite claiming they score things based on publicly available information, and that othres must do the same, they cite absolutely no sources to Daniel to defend their scoring. They light themselves on fire, generate smoke and noise that others have to deal with, and then complain that it's the job of others to put it out.
- eugenekolo 3y ago
  The gaming of the system is the reason they rescores themselves and do not take a vendors statement as fact. There's a long history of vendors underreporting and underscoring their security issues.
  - DannyBee 3y ago
    So? That's a different problem to deal with a different way. People keep lying to me, so i'm going to ignore what they tell me and make it up myself doesn't seem like it's going to generate great results. Put another way - "NVD making stuff up that is not accurate" is not a solution for "other people making stuff up that is not accurate". If you want responsibility, you have to incentivize it somehow, whether carrot or stick. This doesn't achieve that. They can tell their customers whatever they want, and then blame any difference on NVD being mean.
    - 3y ago
brohee 3y ago
They could have a tiered system where at least things that have deployments in the billions get a special treatment. Holidays can be cancelled, releases rescheduled over a bad enough vulnerability in a sufficiently common software. Miscoring a vulnerability makes a thing that is supposed to be good, by promoting a more secure ecosystem, end up being actually bad, wasting resources that could have been spent on solving actual issue. Not even speaking about the lowered trust in NVD...
usea 3y ago
If the scores really mean that little, then the service is doing more harm than good. Spreading lots of false information is not better than nothing. Obviously this comes down to how often they're wrong and by how much.
juancn 3y ago
So stop assessing severity. Rather than do a shitty job, say nothing, like: "Severity not assessed"
- ImPostingOnHN 3y ago
  Interesting thought. The lack of rating might cause rating authorities to pop up and compete with each other for accuracy.

bombcar 3y ago

It's the inverse of the "boy crying wolf" - if they mark a vulnerability low and it ends up being the next log4shell, they look really bad and the organization may be effectively over. But if they rank everything "7+" then they have plausible deniability. So everything will be ranked 7-10. Meaning 1-6 are useless.

rdtsc 3y ago
That was my thought too. Imagine someone at some desk in some drab office building with a huge pile of these to sort though. Different libraries, languages, frameworks etc. They probably have some quota to fill. How motivated are they going to be find out who the authors are, how to contact them, compose a long message, explaining, asking questions? Nah, just look at the code, google a few things, and assign as high of a score as possible. Nobody needs to have someone come and yell at them for assigning a 3 to the next log4shell.

DannyBee 3y ago

"The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not. " Uh, none of this explains why they re-score the vulnerabilities themselves, ignoring the vendor scores and deciding they know best, when they seem to know ... nothing. Which if you read through the links, you'll see is one of the main complaints, and something they document here: https://nvd.nist.gov/general/FAQ-Sections/CVE-FAQs#faqLink9 https://nvd.nist.gov/general/FAQ-Sections/CVE-FAQs#faqLink9 Their take is basically "we get to do this and if it's wrong it's your problem to get us to correct us". That doesn't make any sense. As my child's kindergarten teacher once asked a student: "Do you think if everyone decided to do that, it would turn out okay?" NVD and CVE teams will simply never have the expertise or time or information necessary to actually re-score these things correctly. You'll also note that despite claiming they score things based on publicly available information, and that othres must do the same, they cite absolutely no sources to Daniel to defend their scoring. They light themselves on fire, generate smoke and noise that others have to deal with, and then complain that it's the job of others to put it out.

eugenekolo 3y ago
The gaming of the system is the reason they rescores themselves and do not take a vendors statement as fact. There's a long history of vendors underreporting and underscoring their security issues.
- DannyBee 3y ago
  So? That's a different problem to deal with a different way. People keep lying to me, so i'm going to ignore what they tell me and make it up myself doesn't seem like it's going to generate great results. Put another way - "NVD making stuff up that is not accurate" is not a solution for "other people making stuff up that is not accurate". If you want responsibility, you have to incentivize it somehow, whether carrot or stick. This doesn't achieve that. They can tell their customers whatever they want, and then blame any difference on NVD being mean.
  - 3y ago

brohee 3y ago

They could have a tiered system where at least things that have deployments in the billions get a special treatment. Holidays can be cancelled, releases rescheduled over a bad enough vulnerability in a sufficiently common software. Miscoring a vulnerability makes a thing that is supposed to be good, by promoting a more secure ecosystem, end up being actually bad, wasting resources that could have been spent on solving actual issue. Not even speaking about the lowered trust in NVD...

usea 3y ago

If the scores really mean that little, then the service is doing more harm than good. Spreading lots of false information is not better than nothing. Obviously this comes down to how often they're wrong and by how much.

juancn 3y ago

So stop assessing severity. Rather than do a shitty job, say nothing, like: "Severity not assessed"

ImPostingOnHN 3y ago
Interesting thought. The lack of rating might cause rating authorities to pop up and compete with each other for accuracy.