Good. CVEs were the poster boy of goodharts law for the longest time. Most security vulnerabilities behind CVEs are utterly meaningless.
back
1 comments
Ah! Another one to add to the following list:
- What disease did the CDC ever prevent?
- What improvement did the NHTSA ever bring to full self driving?
- What improvement in airline safety did the FAA bring?
- What good did FEMA do in any disasters?
I don't want to quip about how their achievements are invisible because they prevented the disasters that would have brought the spotlight on them, even when they were too underfunded to properly do their jobs. But I sure would like to see the people making these smart comments to give it a try and see how that goes. Then again, I have no complaints - at this rate, we'll get that chance soon.
Likening CVE database maintainers to natural disaster response teams and an entire country's medical board is quite the achievement in hyperbole, congratulations.
Anyway, my opinion is that CVEs have a very low signal-noise ratio and vulnerability databases in general should be revamped to try and fix that problem. The current system - I don't claim to know the root cause - is simply horrible. It could be the management, the entry requirements, some loophole perhaps, etc,. I also don't claim that this is the motive behind this move, I am just hoping it gets revamped anyway as a side effect (There's another article on HN floating around that says someone else has picked up the baton - good luck to them). I also don't care for your country's politics which you seem to be eluding to in your final paragraph.
Hyperbole according to whom? Clearly, this forum full of tech professionals seem to disagree with you. And I listed those arguments to show how hollow your own argumentation is - not to draw a parallel. But even with that straw-man, how did you decide that such a database has no serious utility to the governments and private institutions worldwide? And what's even worse is how some people belittle others' work without getting even the basic facts right. You neglected the fact that they were underfunded to begin with. So perhaps what's needed to improve their quality is to increase their funding, not cut it further. That's a trick used by some sleazy politicians to justify de-funding and privatizing useful endeavors like these. I find such excuses to be quite dishonest to begin with.
> how did you decide that such a database has no serious utility to the governments and private institutions worldwide
I did not. I said that the signal noise ratio has to be improved. I explicitly used the word "revamp". I know, hyperbole <= hot head => low reading comprehension.
> So perhaps what's needed to improve their quality is to increase their funding, not cut it further.
Sure, if that is the blocker, funding them more is fine by me.
> Good. CVEs were the poster boy of goodharts law for the longest time.
I guess this must have been by somebody else who thinks it's OK to shutdown CVE db because it isn't good enough for them.
> I know, hyperbole <= hot head => low reading comprehension
Try starting with the list in my first reply. Reading comprehension comes later.
> Sure, if that is the blocker, funding them more is fine by me.
Perhaps you should have started with that first before belittling their work. This is exactly what I have been saying all along.
> I guess this must have been by somebody else who thinks it's OK to shutdown CVE db because it isn't good enough for them.
Yes, shutting it down is completely fine by me, letting some other database take its place. It has a chance to be better.
> Perhaps you should have started with that first before belittling their work. This is exactly what I have been saying all along.
I very much intentionally criticised their work - I think the CVE system (the way it runs today) is garbage. You proposed a solution to this situation involving increased funding. I am fine with that solution. Just like I am fine with the solution "nuking it and starting afresh".