Hacker News Reader

Comment by sippingabonedry | Hacker News Reader

There is exactly one CVE in the entire list that is high severity, and it affects an obscure IBM NIC driver for big iron systems used in companies with more money than brains.

You can skip the Xanax this week.

View on HN

Problem is it takes more effort to read the CVE list and work out if you have one of the drivers impacted loaded than it does to just update the kernel.

Sorry but I'm not causing outages and rebooting systems every four days because the people whose job it is to do this can't triage properly. They are actively making other's lives more difficult. There's like 100 CVEs in that list and not a one of them is important to most systems. Even worse, if there was 1/100 it's a needle in a haystack.

If your system goes down to update a kernel then you have a major issue already. This is like manually renewing https certs. When the task is done often enough you just automate it in a painless way.

There is more to the real world than running webshit behind VM clusters.

Real businesses still run legacy file/print services, license daemons, proprietary applications. Some still run on bare metal.

You need outage windows. You can't just YOLO it and update prod during the day, it's unbelieveably irresponsible.

Well then, it's a business decision to accept the risks. IMO it makes sense that a percentage of machines would always be offline for maintenance. If you're running bare metal and you cannot afford 10% of your machines being offline at most times, then you're in deep shit if there's even a tiny traffic irregularity, and it's a sign that your management is YOLOing the company. Not uncommon though.

severity on cve is a crapshoot most of the time, but especially with linux cna. i would not advise relying on them for decision making.

"We can not assign severity

[...]

So any group that attempts to give a “severity score” to a Linux CVE is lying to you, UNLESS they know exactly your use case.

ALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a “fake sense of security”."

http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen...

Reply on news.ycombinator.com