3 ms·

Bad CVEs elsewhere aren't an excuse.

• kuschku 3y ago
  It's not elsewhere, it's bad CVEs everywhere. Curl is just a particularly good example because they document it so well.
  • Avamander 3y ago
    There are many more good and useful CVEs. I'd also kindly request you to suggest a better system.
    • deleted 3y ago
      [deleted]
    • kuschku 3y ago
      Filing a CVE used to be a dialog between the researcher, developers, and third-party domain experts. Accepting every random LLM-generated report and granting it a 9.8 score is not useful in any way. I have to patch hundreds of CVEs in a month, and only a handful are actually valid. The vast majority is "CVSS 9.8: regex complexity explosion in $library" which my project only uses during build. But I've got to patch it, because it's definitely absolutely critical. While the standard library bug that causes SSL connections to fall back to TLS1.1 instead of TLS1.3 by default is considered WONTFIX and gets REJECTED for a CVE.
      • Avamander 3y ago
        That's obviously really unfortunate, but again, what's better out there?