6 ms·
Even if it is really reviewed it is reviewed by somebody who is part of the recent (5 years or so?) explosion of “cybersecurity” and thus incentived to overblow
by dfox 3y ago
Even if it is really reviewed it is reviewed by somebody who is part of the recent (5 years or so?) explosion of “cybersecurity” and thus incentived to overblow the issue.
- muldvarp 3y agoIt's reviewed by someone without any knowledge on the exploitable software. And even if it wouldn't take hours to even set up a testing environment, most CVEs don't include enough information to build an exploit anyway. No need to assume that the reviewers overblow these issues deliberately, there simply isn't anything to meaningfully review in most cases. They can filter out obviously meaningless bullshit, but that's about it. Source: Found a handfull of RCEs for popular PHP projects, some of which have CVEs.
- irrational 3y agoI had a QA coworker who got some online certification and was able to jump into a full remote cybersecurity role at our company with a large pay increase. I’ve worked with her for nearly a decade and while she is pretty good at QA I would never have really seen her as cybersecurity material. Now you say there has been an explosion in this area and I wondering if they are taking any warm body.
- fullspectrumdev 3y agoSome of the best people in security come from QA roles. Security roles largely are just adversarial QA.