Hacker News Reader

When we say a program is "insecure" what do we mean? Do we mean that there is some class of inputs which cause it to behave in a way that it will do any arbitrary computation the designers of the input-data want it to execute?

Or less critically that the designers of the inputs can cause the outputs of the program reveal some information which can be used to implement further exploits?

View on HN

Depends on the situation, which is why CVE also have a CVSS score explaining the context and potential for abuse, e.g. : https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

For example an arbitrary computation is useless for browser exploits (unless you think arb. bitcoin mining is a problem) since Javascript already gives you it for free but it is highly problematic for smart contracts since it breaks the economy based on it.

Another example would be data leak vulnerabilities which on some cases be only a stepping stone towards a RCE, but on others scenarios like for Heartbleed basically breaks the Internet's overall security.

Reply on news.ycombinator.com