logoalt Hacker News

tptaceklast Friday at 10:28 PM2 repliesview on HN

From their perspective, on their project, with the constraints they operate under, bugs are just bugs. You're free to operationalize some other taxonomy of bugs in your organization; I certainly wouldn't run with "bugs are just bugs" in mine (security bugs are distinctive in that they're paired implicitly with adversaries).

To complicate matters further, it's not as if you could rely on any more "sophisticated" taxonomy from the Linux kernel team, because they're not the originators of most Linux kernel security findings, and not all the actual originators are benevolent.


Replies

rwmjlast Friday at 10:35 PM

For sure, but you don't need to file CVEs for every regular bug.

show 1 reply
JCattheATMlast Friday at 11:25 PM

> From their perspective, on their project, with the constraints they operate under, bugs are just bugs.

That's a pretty poor justification. Their perspective is wrong, and their constraints don't prevent them from treating security bugs differently as they should.

show 2 replies