4 ms·
This is the problem: "Service-level contracts and governmental requirements mean that a critical CVE needs to be addressed in short order, so non-critical bugs
by hannob 3y ago
This is the problem: "Service-level contracts and governmental requirements mean that a critical CVE needs to be addressed in short order, so non-critical bugs that get marked that way can cause real problems."
You are right what CVEs are, but there are plenty of people who think CVEs are something different.
- thephyber 3y agoThe CVEs aren’t the problem. You are describing the problems related to Vogons who assume all bureaucratic inputs are perfect. All tickets should have an escape hatch where some person with direct experience with the software can report false positives or “not an issue”. Those are different than the purpose of the article, which is describing the variance of quality of CVE data.
- waihtis 3y agoNot to mention the completely trash cyber risk ratings industry. If you score poorly in because of their absurd scoring methods, it will potentially impact revenue streams if you have to deal with vendor risk departments, etc who don't understand any of the underlying mechanics
- mxmlnkn 3y agoSeems like someone has to file a CVE regarding CVE scores leading to DOS attacks on the developers.
- tptacek 3y agoThe worst possible response to that problem would be to run the CVE program in a way that ratifies it going forward!