• nonentity@sh.itjust.works
    2·
    2 hours ago

    Not all CVEs are equal.

    This is akin to increased testing and diagnostics for a disease, lots of false positives and negatives, plus many flagged instances which would otherwise be benign.

    Increasing visibility is always preferable, but the spectrums of quantity and quality become broader and less consistent as it expands.

      • nonentity@sh.itjust.works
        2·
        1 hour ago

        The one example I’m aware of is prostate cancer. Diagnosis went through the roof when better testing became available, but the majority of the increase wouldn’t have a meaningful impact on the patients life quality or longevity.

        My interpretation of the graph from this post is it’s the initial volley of potential instances from a new diagnostic tool, literally the low-hanging fruit. It’s mildly useful and somewhat interesting, but as with anything constituted from statistics, it’s an incomplete picture.

        • sunbeam60@feddit.uk
          1·
          1 hour ago

          Ah, well I certainly agree with the general notion you’ve stipulated. My question for data was regarding the quality of the CVEs, not the concept.

          • nonentity@sh.itjust.works
            1·
            41 minutes ago

            CVEs are allocated to any issue that gets flagged as a potential security issue; their severity is a subcategory, and their impact and relevance are wildly dependent on context and peripheral elements.

  • BassTurd@lemmy.world
    71·
    11 hours ago

    I assume this is associated with AI. I do wonder if any of the recent CVEs are due to prior patches using AI code.

    • ulterno@programming.devEnglish
      12·
      10 hours ago

      Those will be much harder to find and even harder to fix.
      If there ends up being one, you can expect it to be of the type that one won’t expect there to be in a kernel, so it would be hard to logically track it to the kernel in the first place.

      • BassTurd@lemmy.world
        3·
        7 hours ago

        I don’t know necessarily if they will be harder to find, but I do know that compounding bad fixes to get harder to fix over time. I just think it would be interesting to see if the AI code is responsible for more CVEs in the long term or if it’s just finding more things unrelated to those code changes.