• Kogasa
    link
    fedilink
    English
    arrow-up
    13
    arrow-down
    3
    ·
    9 months ago

    Frivolous CVEs aren’t a good thing for security. This bug was a possible DOS (not e.g. a privilege escalation) in a disabled-by-default experimental feature. It wasn’t a security issue and should have been fixed with a patch instead of raising a false alarm and damaging trust.

    • surewhynotlem@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      1
      ·
      9 months ago

      It is WAY better to over report than under report. I don’t want vendors to have a lot of ability to say “nope that’s not a security problem, sweep it under the rug”.

      • Kogasa
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        3
        ·
        9 months ago

        To a point. Ever heard of the boy who cried wolf?

          • Kogasa
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            9 months ago

            “What if the boy who cried wolf got lucky and didn’t get eaten in the end”? Seems to have missed the point of the parable a bit.

            • SexyVetra@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              9 months ago

              “A liar who lies repeatedly won’t be believed” is definitely equivalent to “A company conservatively warned that one of their products was dangerous in some specific situations.”

              Hanging out with you sounds really fun.

              • Kogasa
                link
                fedilink
                English
                arrow-up
                3
                ·
                9 months ago

                That’s… not the point either. The point is that “reporting false positives isn’t a bad thing” is only true up to a point. The discussion is then “is this before or after that point.” Which, given the context of the bug, isn’t really a given. But I don’t want to have that discussion with you anymore because you’re annoying.

                • SexyVetra@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  9 months ago

                  I am annoying, but something being low-risk and not effecting most customers doesn’t make it a “false positive”.

                  • Kogasa
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    arrow-down
                    1
                    ·
                    9 months ago

                    If only we were still having the conversation.

    • SexyVetra@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      2
      ·
      9 months ago

      Girl, you’re saying you trust software that documents security vulnerabilities that don’t apply to you less than one that doesn’t document those vulnerabilities?

      A CVE isn’t a black mark on a projects reputation.

      Because of the way you misused terms, I’m guessing you’re not particularly familiar with cybersecurity. It’s an ever more important field for sysadmins and devs. I recommend taking the time to learn more.

      • Kogasa
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        3
        ·
        9 months ago

        It’s not worthy of a CVE and whether it applies to me is irrelevant. I didn’t say a CVE is a black mark. Frivolous reporting of CVEs damages trust in the usefulness of the system in identifying critical vulnerabilities. This is a known issue related to resumé padding by newcomers to the cybersecurity industry.

        • SexyVetra@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          2
          ·
          9 months ago

          “Frivolous” “Frivolous” “Frivolous”

          Is it because it’s a DOS? No. That’s valid.

          Feature off by default? No, that still warrants CVE.

          Feature labeled Beta or Experimental? Nope, still warranted.

          You must be one of those newcomers big mad F5 now has control of the record and you can’t pad your cv.

          • Kogasa
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            3
            ·
            edit-2
            9 months ago

            Uh, no. But thanks for guessing. It’s frivolous because it violates several principles of responsible disclosure. Yes, the scope of impact is relevant; the availability of methods of remediation is relevant; and the development/patch lifecycle is relevant. The feature being off-by-default and labeled experimental are indirect references to the scope of impact and availability of remediation, and the latter is an indirect reference to the state of development lifecycle. Per the developer(s)’ words, this is a bug that had limited risk and was scheduled to be fixed as part of the normal development schedule. Escalating every such bug, of which the vast majority go without a CVE, would quickly drown out notices that people actually care about. A CVE is not a bug report.

            • BearOfaTime@lemm.ee
              link
              fedilink
              English
              arrow-up
              1
              ·
              9 months ago

              People who say this should be elevated to CVE haven’t dealt with noise vs signal much.

              Is it a risk, sure, but as you said it was already “experimental”. Experimental shit means “don’t do this in prod, but only in a proper managed lab”.

              That key word: experimental.

            • SexyVetra@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              3
              ·
              9 months ago

              “Uh, no. The CVE is valid, but it’s not about that.” You say, scrambling. “The dev cycle! It was already scheduled for release, so it’s not necessary to disclose. If everyone disclosed security bugs, we’d have too much information and we wouldn’t be able to filter for the notices we care about.” You retort, not realizing that you had already conceded that this wasn’t about the fact you didn’t care about the CVE, and instead arguing that less information is better rather than building tools to cope with the number of CVEs that are increasing regardless of their relevance to you personally.

              • Kogasa
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                2
                ·
                9 months ago

                I didn’t say the CVE was valid. I explained why it was a mistake. I didn’t say “disclosing security bugs” is, in general, a bad thing, I said raising undue alarm about a specific class of bugs is bad. It’s not a matter of “less or more information,” because as I said, a CVE is not a bug report. It is not simply “acknowledgment of information.” If you think my argument has no merit and there is no reason why “more information” could be worse, you’re free to talk to someone who gives a shit.

                • SexyVetra@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  arrow-down
                  2
                  ·
                  9 months ago

                  lol and you said you weren’t big mad.

                  It’s not a matter of “less or more information[…]”

                  Escalating every such bug […] would quickly drown out notices that people actually care about.

                  If your argument is that a specific class of security bugs aren’t worth CVEs, then make that argument. Instead, you’re saying the CVE isn’t valid and making an argument about the risk assessment and development lifecycle (as if those aren’t part of a CVE) and not the class of security bug.

                  I have, this entire time, said it’s a valid CVE that you don’t care about and that you shouldn’t be working as a cybersecurity professional. You have conceded the first point and continued to demonstrate the later.