4 ms·
> If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaw
by shawnz 2y ago
> If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t.
That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not.
This is just an example of where that already existing subjective distinction was applied in a way that not everyone agreed with. It's an unavoidable problem that is going to happen once in a while.
It doesn't mean that CVEs are useless and it doesn't necessarily mean we need to be more liberal about what warrants a CVE either.
- ziddoap 2y ago>That's already the case now, since there's no perfectly objective way to decide whether a bug is even security related or not. Sure, you are right that a line already exists. However, that line basically boils down to "could this bug conceivably affect security". The decision tree is 4 questions long -- very simple. What I am opposed to is someone else answering "yes, this could conceivably affect security" and deciding on my behalf that I don't need to worry about it. That is a line for me (or someone who knows the organizations infrastructure, risk tolerance, etc.) to draw.
- ploxiln 2y agoExcept that in this case, the answer to that question is no, this could not conceivably affect security. It's the rough shape of something that could, but actually it could not. So we're back where we started. It's still subjective, how much you should "conceive the possibility", when it doesn't appear to actually be there.
- deleted 2y ago[deleted]