Thread

1. john_strinlai · 1790902914 · focus · HN ↗

   note that _any_ bugfix is assigned a cve, which makes for big numbers.

   >“Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.”

   <a href="https:&#x2F;&#x2F;docs.kernel.org&#x2F;process&#x2F;cve.html" rel="nofollow">https:&#x2F;&#x2F;docs.kernel.org&#x2F;process&#x2F;cve.html

   &quot;number of cves&quot; is a useless metric, especially when it comes to the kernel.

   1. mbreese · 1790907391 · focus · HN ↗

      &gt; note that _any_ bugfix is assigned a cve

      I do find it interesting though, that in the interest of transparency, every bugfix gets a CVE. Which ends up being a huge number… which will ultimately yield a more insecure environment as we’re getting conditioned to ignore&#x2F;discount CVEs by the volume.

      Over-reporting in this case seems to risk being counterproductive.

      1. weinzierl · 1790922829 · focus · HN ↗

         Counterproductive for whom? The stance of the kernel developers is that whether a bug is a vulnerability or not depends on intended use. They say, we do not dictate use, therefore this decision is out of scope for us. This makes kernel development more focussed and productive.

         I would argue that it is more productive for the enduser as well. Not making a decision they cannot reasonably make is better then blindly believing in a decision that is likely wrong for your usecase.

Unofficial Hacker News client; not affiliated with Y Combinator.