Isn't CVSS 4.0 [0] supposed to at least fix some of these issues?
CVSS Is Dead to Us
11–14 of 14 posts
Re: CVSS Is Dead to Us
#12I hate security theater too, but seriously? Reminds me of people who want to get away from sizing tickets in story points and instead use t-shirt sizes or some other more-abstract measure to avoid confusing the size with the hours/days to implement. But we all do the translation implicitly anyway. You use a scale of 1-4 (okay sure you use ordinal words, but it might as well be numeric for all the difference it makes)…
> You use a scale of 1-4 (okay sure you use ordinal words, but it might as well be numeric for all the difference it makes), and get upset that others use a scale from 0-10 when you boycott their scoring system.
> Simply map your score from your domain over to theirs and move on with your life: Low => 2.5 Medium => 5 High => 7.5 Critical => 10
Mapping a simple 1-4 severity scale onto a 0-10 scale creates a misleading sense of precision. Curl's scale is just a broad categorization—"Low," "Medium," "High," and "Critical" represent general levels of severity, not detailed gradations. And it's a simple to understand scale:
"Low" => Probably doesn't even affect me, I'll give it a look whenever I have some time, or even ignore it. "Medium" => Could affect me, I'll check it out whenever I have a chance. "High" => I should check it out, and will probably have to update. "Critical" => Stop whatever I'm doing, and patch it.
When you assign values like 2.5 or 7.5, it implies distinctions that don’t exist in the original system, such as suggesting there's a meaningful difference between 2.4 and 2.6.
This kind of conversion introduces a false level of granularity, distorting the purpose of the original scale and potentially leading to misinterpretation. For instance, a "Low" severity issue might range from a minor inconvenience to something just short of "Medium," but assigning it a fixed score like 2.5 oversimplifies this range and misrepresents the data.
It also leads to lower trust in the score, since you might see a 2.5 value for something that has a "one in a billion" chance of affecting you, or it's a feature you don't even have enabled in your build, or abuses something specific. So what could be a 1, is represented as a 2.5.
Re: CVSS Is Dead to Us
#13These bullshit “security scans” are disruptive and barely more than box checking exercises by alleged “cyber security” people. I’ve seen entire companies cripple themselves with this security theatre for days on end requiring usually some executive interjection to break the deadlock. Instead of applying nuance, it’s all black and white. I once experienced at a job not being able to deploy urgent hot fixes even for li…
Can confirm. This just happened to my team at work as well. Had to urgently update to "fix" a vulnerability in the linux kernel that had something to do with bluetooth... on a virtual machine running on a rack mounted server in our own datacenter.
I swear, a lot of the security people are some of the dumbest people in the whole building. I even had to explain to one of them why I can't just skip the forced password change needed after I had to reset their password and sent them the new one. I had to explain to one of the security guys that I must not have knowledge of his password, so he needs to immediately change it. Let that sink in...
Re: CVSS Is Dead to Us
#14Isn't CVSS 4.0 [0] supposed to at least fix some of these issues? [0] https://www.first.org/cvss/v4-0/
They seem to have gone for 'add a metric for everything.
'Provider Urgency (U): Amber'
That tells me squat.