Hacker News Reader

> but the point of CVEs is to let you make judgement calls

Realistically, most admins cannot make judgment calls about 1000+ CVEs for a kernel release.

And not only that, remember the hn crowd is not at all representative of the average.

Even more realistically, many admins do not have the background to be able to reason (by themselves) about the actual risk of most CVEs, so just going along with specialized media coverage is often a sound strategy.

>And not only that, remember the hn crowd is not at all representative of the average.

We should keep our hopes up, someday we may get there.

Usually the security team mandates a zero CVE policy on all deployments and the organization complies.

we in security teams can only dream of such incompetent management

zero CVE policy = halt on business development.

Reply on news.ycombinator.com