@adamshostack@infosec.exchange
2026-06-29 17:14 UTC
@pgl@infosec.exchange @jayjacobs@infosec.exchange This is really fascinating.
I think another aspect of a vulnerability is that the security failure either (a) violates an explicit requirement or (b) inarguably violates an implicit requirement.
This ties to the long argument in the early days of CVE about fingerd: fingerd failed to meet (a) or (b). I think a big chunk of CVE success was that we didn't do a lot of those.
Replies (1)
-
@zmanion@infosec.exchange 2026-06-30 15:27
@adamshostack@infosec.exchange @pgl@infosec.exchange @jayjacobs@infosec.exchange I'm initially a fan of the explicit/implicit security policy violation, I think we'd need both: Someone could explicitly declare that they allow remote, unauthenticated access or control of a system, but everyone else may treat that as an implicit violation.