Post #2576533

2026-05-15 06:10 UTC

First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. They are edge cases under highly constructed preconditions. Yes, not impossible, but unlikely to be ever encountered. Before LLMs, no researcher would have invested the time to explore those scenarios. my guess. Yes, we fix them. But, they could also have been a bug report.💁🏻‍♂️

Replies (9)

@swelljoe@mas.to 2026-05-15 06:38

@icing@chaos.social after twenty or thirty years, the really scary stuff has probably already been found in anything popular. (Probably.)

Open ##2886315
@thanius@mastodon.chuggybumba.com 2026-05-15 08:36

@icing@chaos.social The only reason they are CVE's is because of privilege escalation. I'm trying to make colleagues and customers to understand that while yes, these are serious issues, but an attacker would already usually need to have shell access to the system in order to perform the exploits. If that's the case, they have other more security issues. Especially when the server is on a private network without any public entrances

Open ##2886320
@alwayscurious@infosec.exchange 2026-05-15 08:43

@icing@chaos.social I suspect the Linux kernel is an exception.

Open ##2886321
@aris@infosec.exchange 2026-05-15 08:52

@icing@chaos.social at libssh we're considering the policy of filing all bugs under a certain CVSS threshold (5 or 6) as regular bug reports in bug tracking and fix them without any embargo to avoid clogging up the security pipeline

Open ##2886322
@Flominator@genealysis.social 2026-05-15 10:25

@icing@chaos.social And then people observe the changes required to fix the problem and can use them to create their exploit right away, even before the fix is released.

Open ##2886325
@NobodyElse47263@mastodon.social 2026-05-15 11:39

@icing@chaos.social I like to think we're closing the back doors and zero days nation state actors had found and not reported.

Open ##2886326
@PVTejas@mstdn.social 2026-05-15 11:58

@icing@chaos.social and they throw up 5 false positives for every real CVE 1.0 vulnerability

Open ##2886327
@grep@social.bawnet.io 2026-05-15 13:58

@icing@chaos.social The human effort bounded model of security is dead. Edge case dismissals stop working once attackers aren’t human limited.

Open ##2886328
@adamshostack@infosec.exchange 2026-05-17 16:31

@icing@chaos.social When you say "unlikely to be encountered", do you mean "conditions the attacker can't arrange"? (Sorry if this seems nitpicky, I know it's a social media conversation, and it's an important distinction.)

Open ##2886333