Hacker News Reader

Comment by suprjami | Hacker News Reader

> I can look at a CVE and determine for myself and my organization whether it something we need to care about.

Except it doesn't work like this.

A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away.

The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.

View on HN

A decent security scanner allows you to exclude informational vulnerabilities. When I rolled out Wazuh in an org, it allowed for said function. And I still, personally, wanted to know about it at least once.

If that is your attitude to security scanning, you should not be in charge of anything more important than a speak and spell.

Seriously? Treating joke CVEs the same as true sev 1 issues is beyond silly and counter productive. There are very real limits to time, money and attention and pretending otherwise is foolish.

The person you’re replying to seems to agree with you.

Are you speaking from your experience in vulnerability management? If anything, I’ve seen the opposite behavior (ignore everything except where the risk is critical).

CVSS has been around since the mid-2000s, so it isn’t as if there’s no way to discern critical vulnerabilities from informational ones.

>Except it doesn't work like this.

You'll have to email my bosses that :)

Reply on news.ycombinator.com