Conversation

Notices

1. Embed this notice
   Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Wednesday, 26-Aug-2026 04:54:08 JST Graham Sutherland / Polynomial

   I think CVSS scores fundamentally failed by trying to apply one unified rubric to all systems and threat models.

   consider the case where you're reviewing a SoC ASIC with a root of trust ROM, security processor, cryptographic accelerator, and main processor, with an internal AXI bus and external PCIe connection to a host, with each processor having internal security boundaries.

   trying to maintain a coherent view of what "network", "adjacent network", and "local" mean is nearly impossible here.

   • Rich Felker repeated this.
   • Embed this notice
     Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Wednesday, 26-Aug-2026 04:55:19 JST Graham Sutherland / Polynomial

     in reply to

     if you keep everything in a single static view where the high-level system topology is what defines the position, then your CVSS vectors end up misaligned with the actual threat model of the component (e.g. the RoT/secp considers anything outside of it as untrusted), and the scores are wonky.

     if you vary the meaning of attacker position depending on the context of the per-component threat model, the scores are more representative but the vectors almost always confuse people.

     Rich Felker repeated this.
   • Embed this notice
     Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Wednesday, 26-Aug-2026 05:06:01 JST Graham Sutherland / Polynomial

     in reply to

     CVSS is mostly fine (within the bounds of what you can reasonably achieve for a general metric) for the simple cases of network services and web apps and regular software, but really breaks down outside of that.

     And unfortunately I do a lot of "outside of that".