3 ms·
Your assertions contradict the Usenix research cited in TFA, which found that the lifetime of vulnerabilities _do_ follow an exponential decay. If it takes long
by elcritch 2y ago
Your assertions contradict the Usenix research cited in TFA, which found that the lifetime of vulnerabilities _do_ follow an exponential decay. If it takes longer to find a vulnerability, then its lifetime is longer.
- Animats 2y agoWhat the article calls a "vunerability" is something they found internally. Looking at vulnerabilities that were found from attacks, it looks different. [1] Most vulnerabilities are fixed in the first weeks or months. But ones that aren't fixed within a year hang on for a long time. About 18% of reported vulnerabilities are never fixed. [1] https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulnerability https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulne...
- fanf2 2y agoI think that’s about time to deploy fixed code, not about time to discover the vulnerability nor about time to fix the code.