News for hackers. Stuff that matters.

A comment on CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow. Parent comment

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by jacques_chester on Tuesday January 27, 2015 @01:03PM (#8954591)
His point is that severity is orthogonal to the coolness of vulnerability names. And that this will cause whacky priorities in future.

Plus, 99% of the time, end users are not directly responsible for patching these issues. So why the focus on mass-media friendly marketing?

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by Karunamon on Tuesday January 27, 2015 @01:14PM (#8954648)
If the mass media is getting real life sysadmins to get bugged about security holes, how is that anything but a net positive?
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by dsacco on Tuesday January 27, 2015 @04:07PM (#8955897)
That's not the point. The mass media knows nothing about security.

Here is what is happening when vulnerabilities get their own brand names, with logos and marketing:

1. Vulnerabilities are implicitly severe if they attract media attention (and only if they attract media attention). I've been featured in the press twice for vulnerabilities. Neither of them were as serious as the least serious, unpublicized vulnerability on this page: https://hackerone.com/internet.

2. It implicitly encourages rating a vulnerability's severity by how much media attention it receives, not by an objective scale.

It's causing a race to the bottom where coordinated disclosure now requires a PR firm, a presskit, a logo, and a brand name. For Heartbleed and Shellshock, sure, they're serious enough for all those hoops. For everything else, the race to the bottom will commoditize these things, making vulnerabilities without them ignored, and confusing vulnerabilities with them as severe.

The final result is that it's just extra, meaningless noise tacked on to vulnerability disclosure that makes it more difficult to achieve, involves more parties and doesn't improve anything.

[ Parent | on HN ]