Non-determinism is an issue with patching CVEs

#1

Post by mathewpregasen » Fri, May 08, 2026, 9:23 PM UTC

Non-determinism is an issue with patching CVEs
flox.dev

Re: Non-determinism is an issue with patching CVEs

#2

Post by jambay » Fri, May 08, 2026, 9:33 PM UTC

There has been so much discussion about the increase of volume in CVEs. I love that it's super apparent from looking at that graph of CVEs by year, there is a noticeable bend in the slope upward in the 2026 plot. It's not just hype, the rate of CVEs is changing faster than prior years.

Re: Non-determinism is an issue with patching CVEs

#3

Post by LoganDark » Fri, May 08, 2026, 9:34 PM UTC

That is not the title of the article:

> Achieving CVE Remediation in an Era of Escalating Vulnerabilities

Re: Non-determinism is an issue with patching CVEs

#4

Post by tptacek » Fri, May 08, 2026, 9:36 PM UTC

Reads kind of sales-pitchy. Every day we see another actively exploited Linux LPE; have you thought about your SBOM today?

Re: Non-determinism is an issue with patching CVEs

#5

Post by ronef » Fri, May 08, 2026, 9:52 PM UTC

tptacek wrote: post #4

Reads kind of sales-pitchy. Every day we see another actively exploited Linux LPE; have you thought about your SBOM today?

I feel we should definitely be digging way beyond the SBOM... but also wondering if the forecasting in the general ecosystem is on point or not.

Re: Non-determinism is an issue with patching CVEs

#6

Post by ronef » Fri, May 08, 2026, 9:53 PM UTC

ronef wrote: post #5

tptacek wrote: post #4

Reads kind of sales-pitchy. Every day we see another actively exploited Linux LPE; have you thought about your SBOM today?

I feel we should definitely be digging way beyond the SBOM... but also wondering if the forecasting in the general ecosystem is on point or not.

I.e. is this overhyped?

Re: Non-determinism is an issue with patching CVEs

#7

Post by ohnei » Fri, May 08, 2026, 10:25 PM UTC

tptacek wrote: post #4

Reads kind of sales-pitchy. Every day we see another actively exploited Linux LPE; have you thought about your SBOM today?

I like nix and its approach but if I'm being honest I think its also getting easier to be sloppy about dependencies and ask AI to find any dependencies that might be missing from the cleanly installed packaging metadata. There's maybe a paradox for developers in that we can try to drop structure and brute force scan first intensively enough to catch anything likely to get caught or we can ask AI to finally apply all the rigorous methods we decided were too expensive for routine software and probably have minimally more things to run with each release.

Re: Non-determinism is an issue with patching CVEs

#8

Post by tremon » Fri, May 08, 2026, 10:27 PM UTC

tptacek wrote: post #4

Reads kind of sales-pitchy. Every day we see another actively exploited Linux LPE; have you thought about your SBOM today?

Are you offering an easy fix for that "Linux" line on your SBOM?

Re: Non-determinism is an issue with patching CVEs

#9

Post by roylib » Fri, May 08, 2026, 10:38 PM UTC

[dead]

Re: Non-determinism is an issue with patching CVEs

#10

Post by tptacek » Fri, May 08, 2026, 11:37 PM UTC

tremon wrote: post #8

tptacek wrote: post #4

Reads kind of sales-pitchy. Every day we see another actively exploited Linux LPE; have you thought about your SBOM today?

Are you offering an easy fix for that "Linux" line on your SBOM?

No, I'm making an aesthetic critique of a promotional blog post, as an author of commercial technical blog posts myself.