Hacker News Reader

Whether the CVE is found by someone who reports it, or someone that does not makes no difference to the vulnerability of your systems. Better it be in the light, where it can be fixed, than in the darkness.

View on HN

I think having a system which is not insecure by design is better, it doesnt matter then if some poor code makes it into a system, it will be contained be default before it can do any damage.

CVEs are not found, they are applied for. The resume padding sport has resulted in a flood of nonsensical applications.

That’s true, CVE is just the classification. I should have used “vulnerability” twice.

But that people are finding them and padding resumes doesn’t actually make you less secure, the opposite. At least we can know.

The abbrev vuln = clear & understood. Vuln is 1 > letter than CVE. Both require you to know the meaning, but if required vulnerability can be written out. One could do that once, or explain it once. For example in header or first sentence.

Reply on news.ycombinator.com