The Harmless Pi-Hole Bug

Post by Denote6737 » Wed, Aug 21, 2024, 9:39 AM UTC

suprjami wrote: post #19

ziddoap wrote: post #4

Earlier quoted context omitted.

If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t. That would be worse in pretty much every respect. As it is now, I can look at a CVE and determine for myself and my organization whether it something we need to care about. I’d rather that decision stay in my hands, not someone el…

> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Except it doesn't work like this. A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away. The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.

Post by chgs » Wed, Aug 21, 2024, 12:56 PM UTC

ziddoap wrote: post #25

suprjami wrote: post #23

Earlier quoted context omitted.

Except this isn't a CVE anyone will encounter in the workplace because nobody in their right mind would run Pi-Hole on a Raspberry Pi in a professional setting. It's a waste of time. If you want to dedicate staff to reviewing useless garbage issues you do that, go and review every issue logged against other non-commercial software. The rest of us have a job to do.

> The rest of us have a job to do. I'm not sure why you are being hostile about it, but okay. Obviously you feel very strongly about the subject. You should engage with MITRE and encourage them to reconsider their current CVE inclusion decision tree.

Post by Citizen8396 » Wed, Aug 21, 2024, 6:54 PM UTC

suprjami wrote: post #19

ziddoap wrote: post #4

Earlier quoted context omitted.

If you don't assign CVE numbers to every security-related flaw, no matter how minor the flaw may be, you must come up with a way to draw the line on what flaws get CVEs and what ones don’t. That would be worse in pretty much every respect. As it is now, I can look at a CVE and determine for myself and my organization whether it something we need to care about. I’d rather that decision stay in my hands, not someone el…

> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Except it doesn't work like this. A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away. The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.

Post by witrak » Thu, Aug 22, 2024, 6:30 AM UTC

suprjami wrote: post #39

Fnoord wrote: post #28

Earlier quoted context omitted.

Yeah except Bob, your uncle, is working from home and therefore needs to care about his home network security.

I look forward to your explanation of how the temperature of Bob's Raspberry Pi poses a threat to his employer. I also wonder how the attacker got access to Bob's home network in the first place? If only he had the chance to focus on actual important security issues instead of constant notifications about useless noise like the temperature of his Pi-Hole.