• 7 Posts
  • 20 Comments
Joined 1 year ago
cake
Cake day: March 2nd, 2023

help-circle




  • Wrong choices happen when there’s deletion of useful historical data, motivated by short-term cost saving.

    Wrong choices also happen when there’s unnecessary creation on data, such as logging and storing everything, just in case, with a verbose level.

    Storage can be cheap in some cases, but high-availablility high-performance cloud storage is very expensive. Anyway, it’s not infinite.

    The way to keep useful data is to be strategic and only store relevant logs. Fine tune retention policy especially for fastest growing data. Storing everything on high-cost storage, without smart retention policy, could lead to deleting git data to make place for a mix of debug logs and random shit.















  • NVD state they task an analyst to review each CVE and assign a score, then do QC to review the analysis before publication.

    No one’s perfect, but since NVD claim to do QC they should fix their mistakes. So now let’s see how they answer to Daniel Stenberg’s objection. The publication and objections are recent, it’s fair to give them a few days to react.

    But if they’re giving up on doing proper analysis or QC, and are are just acting as a vulnerability number registry, then they shouldn’t publish CVSS values.

    NVD analysts use the reference information provided with the CVE and any publicly available information at the time of analysis to associate Reference Tags, Common Vulnerability Scoring System (CVSS) v3.1, CWE, and CPE Applicability statements

    CVSS V3.1 exploitability and impact metrics are assigned based on publicly available information and the guidelines of the specification.

    Analysis results are given a quality assurance check by another more senior analyst prior to being published to the website and data feeds.

    Source: CVEs and the NVD Process