The bogus CVE problem [LWN.net]

The bogus CVE problem

Posted Sep 15, 2023 3:01 UTC (Fri) by florianfainelli (subscriber, #61952)
In reply to: The bogus CVE problem by wahern
Parent article: The bogus CVE problem

Unfortunately the CVE circus will continue to go on:

- EU CRA: https://www.european-cyber-resilience-act.com/
- US EO 14028: https://www.nist.gov/itl/executive-order-14028-improving-...

this will no doubt create an immense amount of work for projects, distributors, and so on, almost as if it was a jobs program.

to post comments

The bogus CVE problem

Posted Sep 15, 2023 11:42 UTC (Fri) by wtarreau (subscriber, #51152) [Link] (1 responses)

> this will no doubt create an immense amount of work for projects, distributors, and so on, almost as if it was a jobs program.

... or this garbage will convince many of us that too much is too much and it's time to switch jobs, maybe become a european deputee of some other such dummy jobs where you can vote for random rules that morons will blindly apply. I mean, there's no reason we should be their slaves, we're still free to stop maintaining projects that take too much time under such stupid rules, and let the internet fall apart as well.

The bogus CVE problem

Posted Sep 15, 2023 13:17 UTC (Fri) by pizza (subscriber, #46) [Link]

> ... or this garbage will convince many of us that too much is too much and it's time to switch jobs,

This is the most likely outcome.

> we're still free to stop maintaining projects that take too much time under such stupid rules, and let the internet fall apart as well.

Ah yes, but if you stop maintaining it, you're engaging in willful gross negligence and will be on the hook for $very_massive liabilities. And that's where things are heading.

Damned if you do, damned if you don't.

The bogus CVE problem

Posted Sep 22, 2023 6:46 UTC (Fri) by kunitz (subscriber, #3965) [Link]

I work in the financial industry and we live already in the regulated future. Basically if anything in your build has an unresolved high or critical rated CVE, you can't use it anymore. Right now we are in the process to move all our container images to Alpine, because it doesn't use all the user space tools. A normal Debian image has 70 to 100 high or critical rated CVEs.

Since there are so many software packages, nobody has the time to look at the detail of a CVE. If there is a CVE which is high or critical you have to make it disappear, regardless whether you actually use the functionality or expose the service in any way. The financial industry has the audit and governance structures to enforce such rules.

For me it looks like that dependency reduction will become very important in the industry. How open-source will deal with the requirements of the CRA will be interesting to see.