i think it's fine (in concept) to have a central(-ish) numbering scheme for security bugs. so far, so good. but this is made worse in no small part by security

i think it's fine (in concept) to have a central(-ish) numbering scheme for security bugs. so far, so good. but this is made worse in no small part by security researchers, students, companies etc. are all using a CVE as an achievement or some kind of feather in their cap. now, you get thousands of "CVE-2024-10340494: water is wet" and the related "CVE-2024-10340495: if users look up in the rain, they could conceivably drown". of course it would always also have a blog, a custom domain-name, a catchy title/nickname, etc. it's Goodhart's Law in action: "when a measure becomes a target, it ceases to be a good measure." and what else could the Linux devs reasonably do? it was either this or ignore CVE's entirely.