Re:The Cathedral and the Bazaar (1999)
by emodendroket on Monday May 15, 2023 @12:52AM
(#35944011)
I interpret it as synonymous with "found" here -- someone "characterizing" the bug finds it and opens a bug report.
Re:The Cathedral and the Bazaar (1999)
by throwaway173738 on Monday May 15, 2023 @09:58AM
(#35948210)
In professional engineering, you characterize the behavior after someone finds and reports it. Or you characterize a flow transducer, or you characterize gas circuit compliance. It’s the thing you do once you know there’s something to characterize.
Re:The Cathedral and the Bazaar (1999)
by emodendroket on Monday May 15, 2023 @12:37PM
(#35950927)
OK. Well in the variety of work I do, which I suppose isn’t professional by this standard, typically the person who finds a bug and the person who describes it are one and the same.
The key word here is characterized. That word is not equivalent to found.
Security vulnerabilities are unique in that they matter despite being unknown.
Other bugs are only important because of their direct impact on users. It's not unreasonable to take everything here and apply it to known bugs, and not to unknown vulnerabilities.