Item — HN Reader

One can hope that will put pressure on the industry to design a better system than CVEs. The signal noise ratio was already terrible before LLMs, I cannot imagine that will still be a meaningful system in 10y.

But I’m too cynical to not consider all the middlemen who benefit from the status quo

1 comments

It's going to be very very difficult to build this system as the exploitability of any particular CVE can massively vary depending on your system configuration.

There are a lot of things that are bugs, but cannot be exploited in a standard configuration, most people would wonder why this is even a CVE.

But then you have those users that would have the application, then something like a report module that was imported, and another 3rd party module that imports images, and maybe another one that arranges the images in a chart. And suddenly that isolated CVE is now exploitable by user written data because of the original bug, it just required a complex and unexpected chain to get there.

> There are a lot of things that are bugs, but cannot be exploited in a standard configuration

And this describes the vast majority of CVEs you see when you scan your dependencies. Typical case: Your regex library has a denial of service vulnerability for crafted regular expressions but your program never allows users to have any influence over the regex.