Hacker News Reader

Comment by wutwutwat | Hacker News Reader

Isn't that exactly what https://www.cve.org/ would be for?

No, that's the place where you get an identifier for the issue. You still need a place with answers to frequently asked questions, more details as to how the attack works, artifacts and proof-of-concept code, etc.

CVE's usually link to the SCM issue/pull request where the conversation, and reproduction takes place. We've been finding and patching vulnerabilities for decades without the need for dedicated websites to inform folks, so that reason for these sites needing to exist doesn't make any sense.

Yeah, that's not how Apple's CVEs work.

On CVE I see a fact-oriented bug tracker style database of CVE issues with a schmorgus board link/reference barf on each CVE page, but on the OP site I see a really well presented (with videos, faq, paper) description of the issue? It does feel self-marketing yes, but it's entirely deserved if they found the issue?

I'm sure keen folk can digest SCM pull requests, but that population is a super minority I think to well presented content disseminated on youtube, sites, blogs, etc.

I don't think CVE being mandated as the only place vulnerability/conversations are had would be optimal, no?

> schmorgus board

I know HN frowns on grammar-policing comment, and rightly so; but I thought nonetheless you might like to know (and it looks so much more formal this way anyway!) that it's "smörgåsbord" (or the diacritics are commonly omitted in English).

Pronounced [ˈsmœ̂rɡɔsˌbuːɖ]

Bahahaha no, the vast majority of CVE’s are at best a vague description, a severity score, and no context.

Would you send your CFO there though? CTO sure, of course but there’s a whole word of non-technical people who need to consume this kind of information nowadays.

I wouldn't send my CFO anywhere because it has jack shit to do with him and if it ever did, my CTO who would be fine looking at a CVE website and would have zero issue distilling the problem down when HE talks to the CFO, since talking to people like that is part of the CTOs job

That’s certainly your prerogative!

Yes

Reply on news.ycombinator.com