full-disclosure - Open Letter on the Interpretation of "Vulnerability Statistics"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat Jan  7 15:13:18 2006
From: fw at deneb.enyo.de (Florian Weimer)
Subject: Open Letter on the Interpretation of
	"Vulnerability Statistics"

* Georgi Guninski:

>> RVI sources collect unstructured vulnerability information from Raw
>> Sources. 
>
> read: parasites cut and paste from people who can do things.

A service which assigns a primary key shared by multiple databases is
quite helpful.  Of course, you can dismiss this whole vulnerability
tracking/patching thing as completely pointless, and I wouldn't even
disagree with you. 8-)

>> - LACK OF COMPLETE CROSS-REFERENCING BETWEEN RVI SOURCES.
>
> read: coley does not like it that there is no officially recognized 
> usa funded database (NOT a dictionary) to rule em all and manipulate
> statistics.

Uhm, CVE itself adds cross-references to other databases, even to a
non-US one, so I don't think this is a valid criticism.

Unlike PKI or DNS, vulnerability naming does not need to be universal
to be useful.  It does not suffer from the Highlander problem.