3 ms·
> (Maybe take some lessons from academia.) One thing that academia takes seriously and the CVE database doesn't is the reputation of the researcher(s). The CVE
by irdc 3y ago
> (Maybe take some lessons from academia.)
One thing that academia takes seriously and the CVE database doesn't is the reputation of the researcher(s). The CVE database allows one to anonymously make a serious claim against other people's work, and thus avoid consequences if the CVE turns out to be incorrect. In academia this would be unacceptable: reputation is everything.
Now I'm not saying academia does everything right, and it does have a strong tendency for credentialism which is at odds with how security research has always operated. But it makes judging people by their actions a whole lot easier...
- Kalium 3y agoThere are still corners of infosec where doing the wrong kind of research will get you the business end of a massive lawsuit... or a pair of shiny new bracelets. A lot of us started in security in an era where that was more of the rule than the exception. That said, reputation is quite real. For example, taviso is well known for finding weird and scary things.