3 ms·

Individual bugs triggered in normal operation ought to decay over time on software that is maintained. If bugs cause problems, someone may report them and some

Individual bugs triggered in normal operation ought to decay over time on software that is maintained. If bugs cause problems, someone may report them and some fraction of them will be fixed. That's a decay mechanism. Not-yet exploited vulnerabilities, though, don't have that decay mechanism. They don't generate user unhappiness and bug reports. They just sit there, until an enemy with sufficient resources and motivation finds and exploits them. There are more enemies in that league than there used to be.

elcritch 2y ago
Your assertions contradict the Usenix research cited in TFA, which found that the lifetime of vulnerabilities _do_ follow an exponential decay. If it takes longer to find a vulnerability, then its lifetime is longer.
- Animats 2y ago
  What the article calls a "vunerability" is something they found internally. Looking at vulnerabilities that were found from attacks, it looks different. [1] Most vulnerabilities are fixed in the first weeks or months. But ones that aren't fixed within a year hang on for a long time. About 18% of reported vulnerabilities are never fixed. [1] https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulnerability https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulne...
  - fanf2 2y ago
    I think that’s about time to deploy fixed code, not about time to discover the vulnerability nor about time to fix the code.
UncleMeat 2y ago
Vulns aren't just vulns. "Hey, in some weird circumstances we see a uaf here and the system crashes" is the sort of thing you might see in an extremely ordinary crash report while also having significant security implications. You can also uncover latent vulns over time through fuzzing or by adding new code that suddenly exercises new paths that were previously ill-tested. Yes, there are some vulns that truly will never get exercised by ordinary interaction and won't become naturally visible over time. But plenty do get uncovered in this manner.

elcritch 2y ago

Your assertions contradict the Usenix research cited in TFA, which found that the lifetime of vulnerabilities _do_ follow an exponential decay. If it takes longer to find a vulnerability, then its lifetime is longer.

Animats 2y ago
What the article calls a "vunerability" is something they found internally. Looking at vulnerabilities that were found from attacks, it looks different. [1] Most vulnerabilities are fixed in the first weeks or months. But ones that aren't fixed within a year hang on for a long time. About 18% of reported vulnerabilities are never fixed. [1] https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulnerability https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulne...
- fanf2 2y ago
  I think that’s about time to deploy fixed code, not about time to discover the vulnerability nor about time to fix the code.

UncleMeat 2y ago

Vulns aren't just vulns. "Hey, in some weird circumstances we see a uaf here and the system crashes" is the sort of thing you might see in an extremely ordinary crash report while also having significant security implications. You can also uncover latent vulns over time through fuzzing or by adding new code that suddenly exercises new paths that were previously ill-tested. Yes, there are some vulns that truly will never get exercised by ordinary interaction and won't become naturally visible over time. But plenty do get uncovered in this manner.