4 ms·

The gaming of the system is the reason they rescores themselves and do not take a vendors statement as fact. There's a long history of vendors underreporting an

The gaming of the system is the reason they rescores themselves and do not take a vendors statement as fact. There's a long history of vendors underreporting and underscoring their security issues.

DannyBee 3y ago
So? That's a different problem to deal with a different way. People keep lying to me, so i'm going to ignore what they tell me and make it up myself doesn't seem like it's going to generate great results. Put another way - "NVD making stuff up that is not accurate" is not a solution for "other people making stuff up that is not accurate". If you want responsibility, you have to incentivize it somehow, whether carrot or stick. This doesn't achieve that. They can tell their customers whatever they want, and then blame any difference on NVD being mean.
- _a_a_a_ 3y ago
  >> vendors underreporting and underscoring their security issues > So? So he comprehensively refuted your point by explaining why
  - tptacek 3y ago
    No, he called out the obvious reason why NVD would decide it needs to operate this way, without acknowledging that the process they've come up with doesn't work, and is sort of an industry embarassment.
usefulcat 3y ago
The root of the problem is that if NVD lacks the resources to adequately assess CVEs, then they can't do better (well-intentioned or not!) than what the vendor reports, and them trying to do so only adds more noise. Sure the vendors have motive to underestimate, but they're also far better equipped to accurately assess severity. Better to focus on them and hold them accountable.
- Majromax 3y ago
  I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. If NVD completely re-scored submitted CVEs from scratch, then they'd replace a biased dataset with a noisier but unbiased dataset. On the other hand, if NVD accepts high severities and only re-scores low severity CVEs, then the collected database might exchange a low-severity bias for a high-severity bias.
  - usefulcat 3y ago
    > I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. Indeed. It occurs to me that there's a possible feedback loop here. To the exent that NVD increases the severity of all (or even some) CVEs, they are effectively increasing the incentive for vendors to report lower severities, since the vendors may rightly assume that NVD will inflate the severity anyway.
kelnos 3y ago
If vendors were responsible -- and known to be responsible -- for scoring their own security issues, then everyone would at least know that, and understand that the vendor's assessment could be biased. Instead, many people seem to believe they can blindly trust NVD, when their severity assessment is arbitrary and based on wild guessing. And individuals at NVD probably have their own biases as well!

The gaming of the system is the reason they rescores themselves and do not take a vendors statement as fact. There's a long history of vendors underreporting and underscoring their security issues.

DannyBee 3y ago

So? That's a different problem to deal with a different way. People keep lying to me, so i'm going to ignore what they tell me and make it up myself doesn't seem like it's going to generate great results. Put another way - "NVD making stuff up that is not accurate" is not a solution for "other people making stuff up that is not accurate". If you want responsibility, you have to incentivize it somehow, whether carrot or stick. This doesn't achieve that. They can tell their customers whatever they want, and then blame any difference on NVD being mean.

_a_a_a_ 3y ago
>> vendors underreporting and underscoring their security issues > So? So he comprehensively refuted your point by explaining why
- tptacek 3y ago
  No, he called out the obvious reason why NVD would decide it needs to operate this way, without acknowledging that the process they've come up with doesn't work, and is sort of an industry embarassment.

usefulcat 3y ago

The root of the problem is that if NVD lacks the resources to adequately assess CVEs, then they can't do better (well-intentioned or not!) than what the vendor reports, and them trying to do so only adds more noise. Sure the vendors have motive to underestimate, but they're also far better equipped to accurately assess severity. Better to focus on them and hold them accountable.

Majromax 3y ago
I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. If NVD completely re-scored submitted CVEs from scratch, then they'd replace a biased dataset with a noisier but unbiased dataset. On the other hand, if NVD accepts high severities and only re-scores low severity CVEs, then the collected database might exchange a low-severity bias for a high-severity bias.
- usefulcat 3y ago
  > I think the implied premise is that vendors are likely to score with a low bias, downplaying security vulnerabilities. Indeed. It occurs to me that there's a possible feedback loop here. To the exent that NVD increases the severity of all (or even some) CVEs, they are effectively increasing the incentive for vendors to report lower severities, since the vendors may rightly assume that NVD will inflate the severity anyway.

kelnos 3y ago

If vendors were responsible -- and known to be responsible -- for scoring their own security issues, then everyone would at least know that, and understand that the vendor's assessment could be biased. Instead, many people seem to believe they can blindly trust NVD, when their severity assessment is arbitrary and based on wild guessing. And individuals at NVD probably have their own biases as well!