3 ms·

I doubt it's that sophisticated. There's unfortunately an alignment problem where you can boost your resume by saying you "discovered" CVEs, and it's hard for

by rwmj 3y ago

I doubt it's that sophisticated. There's unfortunately an alignment problem where you can boost your resume by saying you "discovered" CVEs, and it's hard for a hiring company to check if a CVE in some random program is bogus garbage or real issue. As a result people are incentivised to file garbage CVEs. See also: garbage answers on Stack Overflow. Edit: To expand a bit on "alignment issue". CVEs are easy to create and are quite a trusted system. There's no penalty for the reporter if they are bogus (discovered or not). Also there's a huge amount of downstream work that happens after a CVE is reported, eg. at Red Hat we have teams of people who run around categorizing and deploying fixes, customers have to update, there are security reporting tools, even government regulations. None of this burden is carried by the reporter if they are wrong.

thayne 3y ago
But these CVEs were filed anonymously. Wouldn't that make it hard to take credit for it? At least in a verifiable way?
- rwmj 3y ago
  Isn't this the person who filed it? https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5XJaoQy6Vv76O7966agez4ffyQktkA%40mail.gmail.com https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5... But even "anonymous" CVEs have this problem since in some teams you can get raises/bonuses based on the number of CVEs you report. See the other reply here: https://news.ycombinator.com/item?id=37406345 https://news.ycombinator.com/item?id=37406345
  - owenmarshall 3y ago
    Not necessarily: that email reported a legitimate bug and identifies a buffer overflow. They don't mention anything about it being exploitable or try to work towards this. Then the CVE was published >20 days later. It's very possible someone else watching the Postgres DL saw an email with "buffer overflow" and pushed it out.
- dylan604 3y ago
  Flipped the other way, prove that the person taking credit didn't file it.

by rwmj 3y ago

thayne 3y ago

But these CVEs were filed anonymously. Wouldn't that make it hard to take credit for it? At least in a verifiable way?

rwmj 3y ago
Isn't this the person who filed it? https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5XJaoQy6Vv76O7966agez4ffyQktkA%40mail.gmail.com https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5... But even "anonymous" CVEs have this problem since in some teams you can get raises/bonuses based on the number of CVEs you report. See the other reply here: https://news.ycombinator.com/item?id=37406345 https://news.ycombinator.com/item?id=37406345
- owenmarshall 3y ago
  Not necessarily: that email reported a legitimate bug and identifies a buffer overflow. They don't mention anything about it being exploitable or try to work towards this. Then the CVE was published >20 days later. It's very possible someone else watching the Postgres DL saw an email with "buffer overflow" and pushed it out.
dylan604 3y ago
Flipped the other way, prove that the person taking credit didn't file it.