It's funny. I was just learning about RuneWatch, which is how the Runescape community attempts to democratize and distribute the problem of dealing with scammer

It's funny. I was just learning about RuneWatch, which is how the Runescape community attempts to democratize and distribute the problem of dealing with scammers. The evolution was basically that it started the way CVEs work. You could submit a report and there wasn't really any verification. Of course, this was abused - far worse than the CVE system, naturally, but the same sort of problem. Now they require a lot of evidence and things are much much better and abuse is far more difficult. It seems sort of obvious. If this is a vulnerability, prove it. It almost feels like a CVE should have a "practical" tag. Like: 1. Is this theoretically exploitable? 2. Is this practically exploitable? 3. Is this proven exploitable? This should be a massive contributor to the score. It also means that a score can be raised by having the sec researcher demonstrate an exploit - so disagreements can be resolved very easily. Related, here's a post from Spender on the topic (since the "CVE bad" situation is nothing new) https://grsecurity.net/reports_of_cves_death_greatly_exaggerated https://grsecurity.net/reports_of_cves_death_greatly_exagger...