4 ms·

>Because sometimes I see people online who compare the number of CVEs in Rust and C/C++ software, [...] a rule of thumb i follow is that the second someone sta

>Because sometimes I see people online who compare the number of CVEs in Rust and C/C++ software, [...] a rule of thumb i follow is that the second someone starts comparing or talking about the number of CVEs, i just ignore whatever they say next. its hard to think of a more useless metric than "number of CVEs", especially now. (edit: the people disagreeing are encouraged to share how you use "number of CVEs" to inform your decision making)

kkishahva 4mo ago
[flagged]
- mswphd 4mo ago
  interesting links > Others think someone from the Rust (programming language, not video game) development community was responsible due to how critical René has been of that project, but *those claims are entirely unsubstantiated* huh > The guy that tried to SWAT me was extremely enthused about Rust: never shut up about it. hm. the guy was also ostensibly a male. should we ban all men from HN? maybe they should be fired and shunned and cast out of society.
  - isuguahs 4mo ago
    [flagged]
  - isurug7wu 4mo ago
    [flagged]
- dtornabene 4mo ago
  yeah this is absurd and a brand new account pushing it too.
  - kwveddlsjggej 4mo ago
    They've been registering new accounts to bring this up in Rust-related threads for months. Their tone has escalated from concern to vitriol, and this is the first I'm seeing open calls for violence. Commenter, whoever you are, I sincerely hope you have people in your life to talk to and that you are doing okay. I am genuinely concerned.
mk89 4mo ago
Oh no, you're in for a surprise. "Especially now" all these infosec folks "need to get CVEs fixed because compliance/SOC2, etc" and they will be even more up your a*! Something has to change with how compliance works. It is so outdated and crazy.
- john_strinlai 4mo ago
  >all these infosec folks i am an infosec folk (:
  - mk89 4mo ago
    Well you're a bit different then... In my experience it is becoming basically ridiculous that we disallow compliance based on a number of cve, their level, etc. It's just a checkbox, but it has nothing to do with security.
    - mk89 4mo ago
      Not sure about the downvote. I'd like to know how a "critical CVE running in your software for 29 days" is acceptable from a security standpoint. With nowadays tooling, these AI agents can take you down in no time if they target you. Compliance the way is done today is basically outdated, but everyone has to follow these rules to sell software basically.
      - tialaramex 4mo ago
        So lets take some recent examples from the sprawling systems my team looks after 1. There's a "critical" severity security issue because we have an obsolete version of some Perl library on a machine that's exposed to outsiders (ie has a public HTTPS website) 1a. The perl library isn't used by any of the software running on that machine, it's presumably either left over from software we no longer use or it was installed to run somebody's one-shot Perl script, possibly years ago, maybe even for a prior incarnation of that system, with the present one installing that library because it's just easier than figuring out which libraries are still needed... 1b Severity CRITICAL. Actual threat: ZERO 2. .NET 8 is obsolete, machines with the .NET 8 CLR are flagged as insecure. 2a. .NET 10 isn't obsolete, that's still supported, in many cases the exact same code, re-compiled with a 10.x version not 8.x was shipped by Microsoft. Is that true for all the cases we care about? Nobody knows, nobody is even interested in working out. Flagged instances will be turned off if they're not fixed so "just" fix it. Busy work. 2b. Severity HIGH. Actual threat: Unknown, possibly negligible? As with Mythos these "AI agents" which can "take you down in no time" can't do the impossible, this isn't a Hollywood movie, mumbling about AI and critical severity CVE doesn't turn that Perl library nobody was using into an actual threat.
cfdryhh 4mo ago
[flagged]
physicsguy 4mo ago
It's alright, just get ISO27001 and list them as risks!

kkishahva 4mo ago

[flagged]

mswphd 4mo ago
interesting links > Others think someone from the Rust (programming language, not video game) development community was responsible due to how critical René has been of that project, but *those claims are entirely unsubstantiated* huh > The guy that tried to SWAT me was extremely enthused about Rust: never shut up about it. hm. the guy was also ostensibly a male. should we ban all men from HN? maybe they should be fired and shunned and cast out of society.
- isuguahs 4mo ago
  [flagged]
- isurug7wu 4mo ago
  [flagged]
dtornabene 4mo ago
yeah this is absurd and a brand new account pushing it too.
- kwveddlsjggej 4mo ago
  They've been registering new accounts to bring this up in Rust-related threads for months. Their tone has escalated from concern to vitriol, and this is the first I'm seeing open calls for violence. Commenter, whoever you are, I sincerely hope you have people in your life to talk to and that you are doing okay. I am genuinely concerned.

mk89 4mo ago

Oh no, you're in for a surprise. "Especially now" all these infosec folks "need to get CVEs fixed because compliance/SOC2, etc" and they will be even more up your a*! Something has to change with how compliance works. It is so outdated and crazy.

john_strinlai 4mo ago
>all these infosec folks i am an infosec folk (:
- mk89 4mo ago
  Well you're a bit different then... In my experience it is becoming basically ridiculous that we disallow compliance based on a number of cve, their level, etc. It's just a checkbox, but it has nothing to do with security.
  - mk89 4mo ago
    Not sure about the downvote. I'd like to know how a "critical CVE running in your software for 29 days" is acceptable from a security standpoint. With nowadays tooling, these AI agents can take you down in no time if they target you. Compliance the way is done today is basically outdated, but everyone has to follow these rules to sell software basically.
    - tialaramex 4mo ago
      So lets take some recent examples from the sprawling systems my team looks after 1. There's a "critical" severity security issue because we have an obsolete version of some Perl library on a machine that's exposed to outsiders (ie has a public HTTPS website) 1a. The perl library isn't used by any of the software running on that machine, it's presumably either left over from software we no longer use or it was installed to run somebody's one-shot Perl script, possibly years ago, maybe even for a prior incarnation of that system, with the present one installing that library because it's just easier than figuring out which libraries are still needed... 1b Severity CRITICAL. Actual threat: ZERO 2. .NET 8 is obsolete, machines with the .NET 8 CLR are flagged as insecure. 2a. .NET 10 isn't obsolete, that's still supported, in many cases the exact same code, re-compiled with a 10.x version not 8.x was shipped by Microsoft. Is that true for all the cases we care about? Nobody knows, nobody is even interested in working out. Flagged instances will be turned off if they're not fixed so "just" fix it. Busy work. 2b. Severity HIGH. Actual threat: Unknown, possibly negligible? As with Mythos these "AI agents" which can "take you down in no time" can't do the impossible, this isn't a Hollywood movie, mumbling about AI and critical severity CVE doesn't turn that Perl library nobody was using into an actual threat.

cfdryhh 4mo ago

[flagged]

physicsguy 4mo ago

It's alright, just get ISO27001 and list them as risks!