Only for major problems, and even then it seems iffy. I have trouble remembering which specific issue Meltdown actually refers to a couple years on.

Personally, I'm totally fine with CVEs. (And if people to stop acting like QIDs are interchangeable, that would be great, too.)

You would have no connection to the underlying vulnerability whatsoever if I just mentioned CVE-2017-5754 to you.

No, but I can establish context in about 10 seconds, and then it doesn't matter.

And you won't remember what WhizzyBadBug refers to in 5 years, you'll have to look it up. It'll only take you 10 seconds or so.

I don't know. The example you chose was Meltdown. I think most people in the field heard Meltdown and can at least place it into the right bucket, of microarchitectural attacks. But more to the point: Meltdown in the moment was far more useful than a CVE number.

Without looking: Struts !!!! But not 100% sure I got it right.

Update: And I'm completely wrong. :-)

It's not a real critical vulnerability unless it has a marketable name and a its own website. Technical names are boring.

While it's cool to talk about heartbleed and people knowing what it was (it even had its own XKCD comic), I fear this marketing trend is detrimental because it's not really aimed at the people who apply the patches/mitigations.

The branding does not help the patching, its for self-promotion of security people. Its incentives go into the wrong direction.