Embed Notice

There's this magical thinking that the CVE ID is what gives attackers the ability to compromise systems.

If you say that your software is vulnerable but fail to assign CVEs, you're only helping the attackers.

I remember the time that Microsoft got mad at me for "leaking" one of their CVEs to the public before the update was available. As in their world, CVE IDs were for Microsoft updates. Not for identifying vulnerabilities. 🤦♂️