|
|
Log in / Subscribe / Register

Resurrecting DWF

Resurrecting DWF

Posted Apr 8, 2021 8:21 UTC (Thu) by zdzichu (subscriber, #17118)
In reply to: Resurrecting DWF by mezcalero
Parent article: Resurrecting DWF

The human factor of using the identifier. CVE-2021-123456 is usable by people when referring to issues. CVE-2021- 123e4567-e89b-12d3-a456-426614174000 is not.
Usability comes from low integer identifiers. In such confined space, some kind of supervision is needed.

to post comments

Resurrecting DWF

Posted Apr 8, 2021 9:06 UTC (Thu) by Karellen (subscriber, #67644) [Link]

It might be possible to treat them like git commit ids, and generally refer to them by a prefix of the full hash, e.g. CVE-2021-123e45. The full hash is still the "real" id though, and if enough are generated in a year that a collision occurs, use a longer prefix from then on.

Resurrecting DWF

Posted Apr 8, 2021 13:56 UTC (Thu) by mezcalero (subscriber, #45103) [Link] (1 responses)

People accepted to live with git hashes. I see no reason why they wouldn't be able to do that for CVEs too. And as mentioned, you can probably shorten them a bit, or encode them in a smarter way, hex encoding is quite wasteful. you could use base32 for example, which needs 26 case-insensitive letters

Resurrecting DWF

Posted Apr 9, 2021 14:05 UTC (Fri) by hailfinger (subscriber, #76962) [Link]

"live with" implies a burden. DWF aims to reduce burdens.

Some people choose not to bear the burden of git hashes. Some of those use mercurial as a frontend for git.

Depending on your viewpoint, there is a difference between "human readable" and "can be understood by humans". A base64 encoded piece of information can be easily read character by character by a literate human being, but decoding the information without help from a computer is a rather rare skill (yes, it's easy in theory, but only few people have memorized the bit patterns).


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds