Post #1455826

2026-04-17 13:08 UTC

@mdekstrand @dsalo The problem with public security vulnerability identification tools is that even if they have a high false positive rate but a real, if small, true positive rate, that's still bad news for a high-visibility target, since it's likely that some set of bad guys who have access to the same tools will check out one of those true vulnerabilities and exploit it. (And these days, pretty much any well-known consumer software or public-facing website is a high-visibilty target.)

Replies (1)

@JMarkOckerbloom@mastodon.social 2026-04-17 13:14

@mdekstrand @dsalo This also leads to various related headaches for developers, not just in double-checking false positives, but also in ensuring that precautions added elsewhere in our environment don't interfere with our own services. One example: My local firewall recently blocked some URLs with "suspicious" character patterns, which indeed might have cause unexpected behavior in a naive script, but were actually encodings of diacritical characters in author names my scripts were expecting.

Open ##1455827