OpenSSL Alarm Fatigue

The boy who cried wolf. And I've seen this with far, far too many other vulnerabilities. It's more of a pattern than not, unfortunately:

- giving the vulnerability a cutesie name "emacsmash" or "shellblast", etc.

- setting the bug to CRITICAL (always in all caps) due to a hypothetical, but unlikely or impractical use case:

   if emacs lisp is configured to provide cgi-bin services to unauthenticated users, and arbitrary user input fields are not properly sanitized, mismatched quasi-quoted macro invocations in user provided data may allow a remote attacker to read arbitrary files on the host system with the permissions of the webserver process, if the default locale is Estonian.

- setting the bug to CRITICAL when the vulnerability is of the nature "and water is wet":

    if inputs to rm -fr command are provided by an untrusted process without proper sanitization, any files and directories accessible by that process owner may be deleted.

Or:

    if a webservice running in a language that provides a data-structure or algorithm that is inherently O(N^m) or O(k^N) and is fed user data of an arbitrary size, a D.O.S. attack can be mounted with polynomial or exponential effect.

- panicking over a very impressive theoretical, probably sensationalized, but highly impractical, attack:

    an attacker using $50 worth of CB-radio equipment has been shown able to read individual keystrokes from 1000ft way using side-band demodulation of the beat pattern between 9600 baud serial terminal and the 24.8832Mhz reference oscillator, excepting of course when there are any other devices nearby that generate in-band noise.

Well most of us don't use emacs as a internet facing bastion and don't expect rm -fr to be safe for anyone except the process owner and have ~237 unknowable internet-of-crap devices on their WiFi (as do their other 18 neighbors within 1000ft) and do not care if you can read their vt100's.

Security stuff is highly context dependent and distilling it down to "HIGH", "MEDIUM", "LOW", etc. is terrible. And it saps effort and energy reacting to things that are real but not applicable 90-99% of the time.