News for hackers. Stuff that matters.

A comment on CVE program faces swift end after DHS fails to renew contract. Parent comment

Re:CVE program faces swift end after DHS fails to renew cont... by icameron on Tuesday April 15, 2025 @11:18PM (#43701094)
Yeah like when we bundled in a .js library for client side date processing that has a CVE affecting node.js servers with high score. Our auditors don’t care they tag the whole app as high risk. It doesn’t even run on the server!
[ Parent | on HN ]
Re:CVE program faces swift end after DHS fails to renew cont... by czk on Tuesday April 15, 2025 @11:25PM (#43701129)
the auditors that sign off on your security to meet your clients requirements usually know way less about your security posture than your clients do

its all just surface-level box-checking. most companies required to get 'penetration tests' just get an overpriced Nessus scan sold as a pentest and that meets their reqs.

[ Parent | on HN ]
Re:CVE program faces swift end after DHS fails to renew cont... by JohnMakin on Wednesday April 16, 2025 @12:27AM (#43701478)
while this is true it in no way diminishes the value that orgs like cve provide
[ Parent | on HN ]
Re:CVE program faces swift end after DHS fails to renew cont... by jeroenhd on Wednesday April 16, 2025 @06:27AM (#43703635)
Incompetent auditors don't detract from the classification system, though. If we removed every data point auditors misinterpret or don't care to understand, we may as well remove all metrics.
[ Parent | on HN ]