4 ms·
You would be ASHAMED how many websites and companies with software have "Won't fix vulnerabilities". The list to which I have reported is long....
by theboss 13y ago
You would be ASHAMED how many websites and companies with software have "Won't fix vulnerabilities". The list to which I have reported is long....
- loceng 13y agoWouldn't it be valuable for a public website to list these? Surely the people who want to take advantage of these vulnerabilities already have these lists and circulate them - why not allow people in general to see them and who has them, and allow them the choice to use the services or not?
- evv 13y agoThats a genuinely great idea! If that site had decent image/marketing, it could go a long way into shaming companies into secure practices. The closest thing we have right now is the EFF https://www.eff.org/ https://www.eff.org/
- forgottenpass 13y agohttp://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=facebook http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=facebook ? I don't use CVE much, just know about it's existence. Are there properties of this database that make it less than what you're pitching?
- theboss 13y agoCVE database is really really bad. Mitre says their limited funding means they are unable to fit all vulnerabilities into the database. There are MANY MANY MANY vulnerabilities that are not in the CVE database. NVD, CVE, BugTraq, PacketStorm, OSVDB, etc.etc. they can't catch them all.
- theboss 13y agoThey should get a BugTraq ID or go into OSVDB, however, that isn't always the case. These should be reported, and if they are serious, documented.