2 ms·
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades.
by aliasxneo 2mo ago
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
- nathancahill 2mo agoThis is how Vanta et al. make millions.
- paulryanrogers 2mo agoI don't think Vanta itself even scans for CVEs? They scan for compliance which includes tooling that may look for CVEs, like Dependabot. Scanning companies should be sophisticated enough to distinguish invalid CVEs and back ported fixes.
- lokar 2mo agoMy favorite urgent must fix CVE from compliance was a bug in the Linux PCMCIA driver on some EC2 VMs.
- sriram_sun 2mo agoWhy is that even part of the image?
- lokar 2mo agoIt was a stock/default kernel setup, before my time.
- chrismorgan 2mo agoI don’t say it’s the case there (it probably isn’t, you probably need hardware access or root), but sometimes those sorts of things do actually matter because there’s a way of causing them to be run anyway. This is why it’s good to exclude things you don’t need. The less there is, the fewer places there are for problems to lurk.
- lokar 2mo agoNot against fixing it, but at the next normal update, it an emergency.