5 ms·

Isn't that exactly what https://www.cve.org/ https://www.cve.org/ would be for?

HtmlProgrammer 3y ago
Yes
saagarjha 3y ago
No, that's the place where you get an identifier for the issue. You still need a place with answers to frequently asked questions, more details as to how the attack works, artifacts and proof-of-concept code, etc.
- wutwutwat 3y ago
  CVE's usually link to the SCM issue/pull request where the conversation, and reproduction takes place. We've been finding and patching vulnerabilities for decades without the need for dedicated websites to inform folks, so that reason for these sites needing to exist doesn't make any sense.
  - saagarjha 3y ago
    Yeah, that's not how Apple's CVEs work.
  - mrmuagi 3y ago
    On CVE I see a fact-oriented bug tracker style database of CVE issues with a schmorgus board link/reference barf on each CVE page, but on the OP site I see a really well presented (with videos, faq, paper) description of the issue? It does feel self-marketing yes, but it's entirely deserved if they found the issue? I'm sure keen folk can digest SCM pull requests, but that population is a super minority I think to well presented content disseminated on youtube, sites, blogs, etc. I don't think CVE being mandated as the only place vulnerability/conversations are had would be optimal, no?
    - JadeNB 3y ago
      > schmorgus board I know HN frowns on grammar-policing comment, and rightly so; but I thought nonetheless you might like to know (and it looks so much more formal this way anyway!) that it's "smörgåsbord" (or the diacritics are commonly omitted in English).
      - dskrvk 3y ago
        Pronounced [ˈsmœ̂rɡɔsˌbuːɖ]
  - deleted 3y ago
    [deleted]
  - fullspectrumdev 3y ago
    Bahahaha no, the vast majority of CVE’s are at best a vague description, a severity score, and no context.
eep_social 3y ago
Would you send your CFO there though? CTO sure, of course but there’s a whole word of non-technical people who need to consume this kind of information nowadays.
- wutwutwat 3y ago
  I wouldn't send my CFO anywhere because it has jack shit to do with him and if it ever did, my CTO who would be fine looking at a CVE website and would have zero issue distilling the problem down when HE talks to the CFO, since talking to people like that is part of the CTOs job
  - eep_social 3y ago
    That’s certainly your prerogative!

Yes

No, that's the place where you get an identifier for the issue. You still need a place with answers to frequently asked questions, more details as to how the attack works, artifacts and proof-of-concept code, etc.

wutwutwat 3y ago
CVE's usually link to the SCM issue/pull request where the conversation, and reproduction takes place. We've been finding and patching vulnerabilities for decades without the need for dedicated websites to inform folks, so that reason for these sites needing to exist doesn't make any sense.
- saagarjha 3y ago
  Yeah, that's not how Apple's CVEs work.
- mrmuagi 3y ago
  On CVE I see a fact-oriented bug tracker style database of CVE issues with a schmorgus board link/reference barf on each CVE page, but on the OP site I see a really well presented (with videos, faq, paper) description of the issue? It does feel self-marketing yes, but it's entirely deserved if they found the issue? I'm sure keen folk can digest SCM pull requests, but that population is a super minority I think to well presented content disseminated on youtube, sites, blogs, etc. I don't think CVE being mandated as the only place vulnerability/conversations are had would be optimal, no?
  - JadeNB 3y ago
    > schmorgus board I know HN frowns on grammar-policing comment, and rightly so; but I thought nonetheless you might like to know (and it looks so much more formal this way anyway!) that it's "smörgåsbord" (or the diacritics are commonly omitted in English).
    - dskrvk 3y ago
      Pronounced [ˈsmœ̂rɡɔsˌbuːɖ]
- deleted 3y ago
  [deleted]
- fullspectrumdev 3y ago
  Bahahaha no, the vast majority of CVE’s are at best a vague description, a severity score, and no context.

eep_social 3y ago

Would you send your CFO there though? CTO sure, of course but there’s a whole word of non-technical people who need to consume this kind of information nowadays.

wutwutwat 3y ago
I wouldn't send my CFO anywhere because it has jack shit to do with him and if it ever did, my CTO who would be fine looking at a CVE website and would have zero issue distilling the problem down when HE talks to the CFO, since talking to people like that is part of the CTOs job
- eep_social 3y ago
  That’s certainly your prerogative!