Re:GitHub’s database of security advisories is now open source
by charcircuit on Saturday February 26, 2022 @10:48PM
(#30485234)
>Then supposedly major alerts start to feel normal
Major alerts should feel normal. I should have said that you shouldn't feel alarmed instead of suggesting that it shouldn't be treated as an event. Maybe that doesn't quite capture what I mean, but you should get the picture. You should be prepared to handle them. Unfortunately, security defects are to be expected and it shouldn't be a surprise that they might exist in your system.
>and when there is an actually major alert nobody has a sense of urgency about it.
Why? You should be urgent with all security issues. You shouldn't have people putting off security updates because they are minor.
Re:GitHub’s database of security advisories is now open source
by dec0dedab0de on Sunday February 27, 2022 @09:33PM
(#30495636)
Sure, but it's like the boy who cried wolf. If the tool keeps saying things are a bigger issue than they are, then people will stop believing the tool.
Re:GitHub’s database of security advisories is now open source
by jimmygrapes on Saturday February 26, 2022 @09:29PM
(#30484742)
See also almost every oil refinery catastrophe. "It's normal for that alarm to go off/to not go off, or for that minor leak to flare up from time to time" and then one day the ignored or missed alert could've prevented death.
Re:GitHub’s database of security advisories is now open source
by charcircuit on Saturday February 26, 2022 @10:57PM
(#30485274)
There should be a process that gets followed for every alert. You shouldn't ignore or miss any alerts.
That is almost the definition of alert fatigue. The problem is tools presenting minor issues as major ones because they might be a major issue in certain circumstances. Then supposedly major alerts start to feel normal, and when there is an actually major alert nobody has a sense of urgency about it.
I've never used GitHubs version of this, but I've used others and as someone who only develops internal tools I wish there was an setting for "I mostly trust my authenticated users." Which I think would downgrade "possible DOS from a specially crafted regex from an authenticated user."