Being discussed at https://news.ycombinator.com/item?id=33422837

Comments moved thither. Thanks!

Procedural note: I hate cases like this where of two posts on the same story, the later one has the better URL. If we merge into the earlier thread (which is arguably fairest) and then change the URL to the better one (which is important for thread quality), then the later submitter ends up without karma for posting the better URL.

Of course karma is pointless (heh) and silly, but as long as we have it we should distribute it fairly. One of these years, we'll fix this problem. In the meantime, sorry wylie39!

> Q: Is this a branded vulnerability?

> A: The OpenSSL project has not named or created logos for either CVE. The best way to refer to them is via the CVE names to avoid confusion.

I chuckled a bit, but im also sad that we ended up in this situation. The obsession with brands is, to some extent, unhealthy.

Maybe we should set up a naming system just like for COVID variants

No, it's not. Branded vulnerabilities are memorable. CVE numbers aren't.

Only for major problems, and even then it seems iffy. I have trouble remembering which specific issue Meltdown actually refers to a couple years on.

Personally, I'm totally fine with CVEs. (And if people to stop acting like QIDs are interchangeable, that would be great, too.)

You would have no connection to the underlying vulnerability whatsoever if I just mentioned CVE-2017-5754 to you.

No, but I can establish context in about 10 seconds, and then it doesn't matter.

And you won't remember what WhizzyBadBug refers to in 5 years, you'll have to look it up. It'll only take you 10 seconds or so.

I don't know. The example you chose was Meltdown. I think most people in the field heard Meltdown and can at least place it into the right bucket, of microarchitectural attacks. But more to the point: Meltdown in the moment was far more useful than a CVE number.

Without looking: Struts !!!! But not 100% sure I got it right.

Update: And I'm completely wrong. :-)

It's not a real critical vulnerability unless it has a marketable name and a its own website. Technical names are boring.

While it's cool to talk about heartbleed and people knowing what it was (it even had its own XKCD comic), I fear this marketing trend is detrimental because it's not really aimed at the people who apply the patches/mitigations.

The branding does not help the patching, its for self-promotion of security people. Its incentives go into the wrong direction.

It probably serves them better that they haven't. It'd turn it into a meme like Heartbleed that would not be forgotten for the next decade.

This is nowhere near as severe as Heartbleed. That's why it's not considered Critical (and also why it hasn't been given a special name.)

Since they declined to name it, we get to name it for them, right? Let's call it CertHurt.

RCE-mail? Hopefully someone can work "Cert" in, but all my attempts broke up the meter of saying it

Of course, that's cheating a little since we now know that it's not _automatically_ an RCE

NCSC is calling it SpookySSL but I think it is just for funsies. https://github.com/NCSC-NL/OpenSSL-2022