4 ms·

Because of incoming CRA and existing requirements, having CVE causes wide, lasting, high impact consequences for people maintaining software and hardware produc

by 112233 3y ago

Because of incoming CRA and existing requirements, having CVE causes wide, lasting, high impact consequences for people maintaining software and hardware products, infrastructure and services. Since barrier of entry for CVE is as low as "logged in user can crash system by filling disk/ram, can cause data leak i think" and that thing can get assigned high marks depending on the randomness of this whole process, you are in a situation of "one bogus report to cripple all users of open source library" cve is not a bugzilla

thephyber 3y ago
Who is more likely to be able to score a CVE accurately — a nameless faceless CVE triager at NIST (or similar organization) who is working as a liaison between the reporter and the maintainer… or the maintainer himself? The CVE is a pure record. It has not guarantee of accuracy and should be treated with this knowledge. That’s what tptacek’s comment is saying. People who attach all sorts of contractual requirements on the assumption that every CVE is perfectly reported and recorded are setting themselves up for inevitable garbage-in, garbage-out situations. Also, if you’re curious, you should check out his post history. He’s kinda famous on HN in the security space.
- 112233 3y ago
  Yes, please, tell all those auditors, security scanner vendors and journalists that they should treat CVEs with this knowledge. That having report with "1 critical vulnerability (CVE-2082-555) !!!!" does not mean that you have a security problem, and your equipment vendor has to drop everything and go fix that. You are telling me what CVE is. I am telling you what the effect of having CVE is.
  - msm_ 3y ago
    I mean, do tell them that because you're right. CVEs are not broken, your auditors, security scanner vendors and journalists are. Sounds like if you replace CVEs with another system you'll get exactly the same mess.

by 112233 3y ago

thephyber 3y ago

Who is more likely to be able to score a CVE accurately — a nameless faceless CVE triager at NIST (or similar organization) who is working as a liaison between the reporter and the maintainer… or the maintainer himself? The CVE is a pure record. It has not guarantee of accuracy and should be treated with this knowledge. That’s what tptacek’s comment is saying. People who attach all sorts of contractual requirements on the assumption that every CVE is perfectly reported and recorded are setting themselves up for inevitable garbage-in, garbage-out situations. Also, if you’re curious, you should check out his post history. He’s kinda famous on HN in the security space.

112233 3y ago
Yes, please, tell all those auditors, security scanner vendors and journalists that they should treat CVEs with this knowledge. That having report with "1 critical vulnerability (CVE-2082-555) !!!!" does not mean that you have a security problem, and your equipment vendor has to drop everything and go fix that. You are telling me what CVE is. I am telling you what the effect of having CVE is.
- msm_ 3y ago
  I mean, do tell them that because you're right. CVEs are not broken, your auditors, security scanner vendors and journalists are. Sounds like if you replace CVEs with another system you'll get exactly the same mess.