alt Hacker NewsThis becomes fun if you start to prioritize security work on CVEs rated higher, not affecting you, over security work on CVEs rated lower and affecting you.
Or prioritizing chasing CVEs currently not affecting you over architectural work improving security.
The CVE should be fixed, I fully agree, but where does it land as a priority? Less competent security teams push /all/ CVEs as Sev0 over /all/ other topics.
I don't have a good answer to this problem. The reality is security is becoming very important - for good reasons. If you (as an organization) are spending all your time chasing CVEs instead of the other useful things (such as what you named) you have a problem, but not fixing CVEs right away is a terrible answer. There is some hope that LLMs have found most of the existing issues and things will settled down - but only time will tell if this becomes true or not.