Hacker News Reader

Comment by LoSboccacc | Hacker News Reader

I hate the generic sounding levels anyway, they explain nothing. I'd much prefer to see business relevant levels.

Those vulnerability still can fit into nice categories like 'remote code execution' 'denial of service' 'local code execution' 'remote information leak' 'loacal information leak' and those could also directly communicate what the bug is all about without 500 words explanation for each single level.

View on HN

With those categorisations a maybe-probably-theoretical-phase-of-the-mooon vulnerability such as CVE-2010-1633 gets put into the same category ("remote information leak") as Heartbleed. This is why severity levels exist.

But it seems to me the difference you are pointing to is in probability of the adverse possibility being realized rather than severity of the impact if the adverse possibility is realized. In risk management, these are usually rated on separate axes.

That probability assessment is pretty dangerous to rely on. Lots of vulnerabilities look extremely improbable, until the exploit tool starts to circulate. This is an age-old problem in software security: when you try to score things in a risk management rubric, you wind up hair-on-fire over simple vulnerabilities that managers can understand, and wind up not fixing sophisticated vulnerabilities that will be commonplace among attackers soon.

It's also important to remember that there's a window in which this stuff gets fixed, probably just weeks long, anchored to the announcement of the vulnerability. Once that window passes, any update you're going to see about exploitability is basically going to announce "everyone is now owned". That's a failure of vulnerability scoring!

I don't disagree with the idea that probability has a lower value in this type of software security risk assessment than some others; my point was that probability is a different thing than severity, so that it is not necessarily an error that issues with a different probability of being exploited but similar consequences get the same severity rating.

Your point, however, is well made.

Reply on news.ycombinator.com