3 ms·
One can hope that will put pressure on the industry to design a better system than CVEs. The signal noise ratio was already terrible before LLMs, I cannot imagi
by dgellow 3mo ago
One can hope that will put pressure on the industry to design a better system than CVEs. The signal noise ratio was already terrible before LLMs, I cannot imagine that will still be a meaningful system in 10y.
But I’m too cynical to not consider all the middlemen who benefit from the status quo
- pixl97 3mo agoIt's going to be very very difficult to build this system as the exploitability of any particular CVE can massively vary depending on your system configuration. There are a lot of things that are bugs, but cannot be exploited in a standard configuration, most people would wonder why this is even a CVE. But then you have those users that would have the application, then something like a report module that was imported, and another 3rd party module that imports images, and maybe another one that arranges the images in a chart. And suddenly that isolated CVE is now exploitable by user written data because of the original bug, it just required a complex and unexpected chain to get there.
- dns_snek 3mo ago> There are a lot of things that are bugs, but cannot be exploited in a standard configuration And this describes the vast majority of CVEs you see when you scan your dependencies. Typical case: Your regex library has a denial of service vulnerability for crafted regular expressions but your program never allows users to have any influence over the regex.