The gamification of CVEs has been a real negative for people that actually have to deal with them.
Whether the CVE is found by someone who reports it, or someone that does not makes no difference to the vulnerability of your systems. Better it be in the light, where it can be fixed, than in the darkness.
I think having a system which is not insecure by design is better, it doesnt matter then if some poor code makes it into a system, it will be contained be default before it can do any damage.
CVEs are not found, they are applied for. The resume padding sport has resulted in a flood of nonsensical applications.
That’s true, CVE is just the classification. I should have used “vulnerability” twice.
But that people are finding them and padding resumes doesn’t actually make you less secure, the opposite. At least we can know.
The abbrev vuln = clear & understood. Vuln is 1 > letter than CVE. Both require you to know the meaning, but if required vulnerability can be written out. One could do that once, or explain it once. For example in header or first sentence.
For some, it’s not a game, but an opportunity or directive. Would you prefer to to patch or do IR?