Hacker News Reader

The worst is when some build tool has a bad regex backtracking implementation leading to denial of service with bad patterns.

Of course the right answer is to just keep upgrading our dependencies... so our build machine doesn't fall into an infinite loop when a hacker rewrites our build scripts?

I don't think summarizing the criticality of a vulnerability as a single number is possible. Many vulnerabilities really are critical, but only to some users of a software that have some feature enabled (that might be disabled by default). The best way to communicate the criticality of a vulnerability is in text.

Vuln ratings are totally divorced from reality. Sometimes the super scary ones will be marked as low or medium too.

I’ve also had zealots want to introduce some pretty significant nonsense to CI for these. I enjoyed when that meant the CTO began getting emails about my products having critical vulnerabilities. Except, uh, we don’t ever use a single Django template and whatnot.