Hacker News Reader

Comment by wnevets | Hacker News Reader

is it just me or a lot more exploits are getting dedicated websites, names and press releases these days? It reminds me of the weather channel naming snow storms like hurricanes.

View on HN

Heartbleed was the first one to do that: they gave it a suitably scary name, dedicated website, and logo. The result is that the media went wild over it, and people have been trying to replicate that reaction ever since.

And they didn't go wild over the next one because as far as anyone not involved in the technical end, nothing happened. It looked like everyone cried wolf.

Generating hype by marketing issues doesn't work.

If it got people to update, then it worked.

Except that there's some analogue of 'outrage fatigue' ('security fatigue'?). If the publicity is too successful in averting the problem, then there's a danger that, rather than correctly deducing "the loud publicity worked", some will deduce "the loud publicity is unnecessary"—and so future warnings will be ignored under the impression that they are 'crying wolf'.

Not a bad thing IMO. It brings more attention to security issues which is good for public awareness.

Also makes it easier for IT to pitch the downtime to execs if it's something the execs have heard of or can visit a website for with a simple description of the threat.

Doesn't the law of diminishing returns start to kick in quickly? Correct me if I'm wrong but this exploit doesn't seem to be close to the potential impact as heartbleed.

The problem is that it can generate vulerability fatigue, especially when some of the named vulns turn out not to actually be that serious.

After the first 10 or 20 people will see it as de rigeur and stop paying attention again...

Branding works

Reply on news.ycombinator.com