Hacker News Reader

Comment by justusthane | Hacker News Reader

> I really appreciate this attitude towards this because it recognizes that there are a lot of security teams out there that don't take a nuance view of CVEs

This is true, but also: needless CVEs place a burden even on security teams who do take a nuanced view of CVEs - it requires some amount of effort to evaluate every CVE and determine whether it's applicable or not.

View on HN

In many (most?) companies it also takes nontrivial amount of time to patch potentially affected systems. In my company half IT department got recently an email that we need to urgently patch all Windows servers because of some critical CVE. I checked it. The description was maybe 3 lines and it said this affected domain controllers only. I raised this with security team and they said that in this case we don't need to patch everything. Now if we had to do this, it would force us to spend nontrivial time on unplanned patching. That this in itself disorganizes our operations can not be ignored. So comparatively me doing some legwork and checking the CVE was trivial effort and saved a lot of busywork for the department as a whole. That time we got lucky.

If something is hard do it more often so you get good at it.

While this time you avoided something, it sounds like you need to figure out your patching process ASAP. There is every reason to believe a major issue will affect everything in the near future.

Absolutely. I was focused on the burden CVEs place on everyone downstream of teams that don't take a nuance view, but even when teams do look at all the CVEs reported in scans, the proliferation of CVEs just adds workload to determine if they are affected. Unless teams say they will not look at lows (or lower-than-lows if the category existed) then what amounts to busy-work just piles up.

There's an upcoming talk at the OpenSSL conference next month on the cost of bogus CVEs to open-source projects that covers similar ground. It also lists some particularly ridiculous CVEs that, despite being jawdroppingly stupid, still need to be responded to by project maintainers who really have better things to do with their lives.

Reply on news.ycombinator.com