48
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 31 Oct 2026
48 points (90.0% liked)
Linux
15412 readers
717 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS
Not all CVEs are equal.
This is akin to increased testing and diagnostics for a disease, lots of false positives and negatives, plus many flagged instances which would otherwise be benign.
Increasing visibility is always preferable, but the spectrums of quantity and quality become broader and less consistent as it expands.
That’s a nice hot take. Got any data to back that up?
The one example I’m aware of is prostate cancer. Diagnosis went through the roof when better testing became available, but the majority of the increase wouldn’t have a meaningful impact on the patients life quality or longevity.
My interpretation of the graph from this post is it’s the initial volley of potential instances from a new diagnostic tool, literally the low-hanging fruit. It’s mildly useful and somewhat interesting, but as with anything constituted from statistics, it’s an incomplete picture.
Ah, well I certainly agree with the general notion you’ve stipulated. My question for data was regarding the quality of the CVEs, not the concept.
CVEs are allocated to any issue that gets flagged as a potential security issue; their severity is a subcategory, and their impact and relevance are wildly dependent on context and peripheral elements.