1. I would like this better if it were not in LLM-speak.
2. You do not owe your employer more than your 40 hours per week (average). If you're overworked, that's a decision on your employer's part. Do what you can, advocate for appropriate investment in compensating controls, burn-down of tech debt, prioritize the issues... but don't hurt yourself.
Interesting graph. It looks like that the upward trend started around 2017, long before mainstream LLMs. Is this also tooling related, such as Snyk etc. or just more software to find CVE in therefore more CVEs found?
I think the growth pattern since 2017 doesn't need much more explanation than the "natural" growth of the software and security ecosystems and practices.
It's since a couple of months ago that things have gotten completely out of control.
As much as I'm for releasing everything people learned and patching all-the-things soon, I would really like it if nobody was an asshole around Christmas. You can wait until next year - just let people rest - there's no point doing disclosures then from the non-malicious side.
I believe at the current rate, it should be considered to look to different ways to audit your software instead of CVEs. It was already unmanageable before AI, now it is impossible to triage.
Opening the dev console in Safari and Chrome, there's an injected https://static.cloudflareinsights.com/beacon.min.js tag at the very end of the body. If I curl the site, it's not injected, but if I copy as cURL from Chrome's dev tools and run that curl command, the script is injected again.
> I patched on Monday. Tuesday was Patch Tuesday. Wednesday was Exploit Wednesday, because somebody read Tuesday’s diff.
Claude wrote this. And you can tell nobody actually read carefully, because it couldn't even get three items into a list without saying something incongruous (if somebody "read Tuesday's diff", that's Tuesday's CVE, not a new one on Wednesday, the thing being complained about).
There's some irony in releasing a wholly AI-generated page with a lack of attention to detail to complain about the AI-induced security catastrophe stemming from a lack of attention to detail.
You're nitpicking. It's a week of security related work. It makes sense. The idea is that people dealing with new issues need a break - doesn't matter when the cve was assigned.
Valid, but...
1. I would like this better if it were not in LLM-speak.
2. You do not owe your employer more than your 40 hours per week (average). If you're overworked, that's a decision on your employer's part. Do what you can, advocate for appropriate investment in compensating controls, burn-down of tech debt, prioritize the issues... but don't hurt yourself.
I hear you. This pretty daunting: https://cve.0xosprey.com/
Interesting graph. It looks like that the upward trend started around 2017, long before mainstream LLMs. Is this also tooling related, such as Snyk etc. or just more software to find CVE in therefore more CVEs found?
I think the growth pattern since 2017 doesn't need much more explanation than the "natural" growth of the software and security ecosystems and practices.
It's since a couple of months ago that things have gotten completely out of control.
As much as I'm for releasing everything people learned and patching all-the-things soon, I would really like it if nobody was an asshole around Christmas. You can wait until next year - just let people rest - there's no point doing disclosures then from the non-malicious side.
I believe at the current rate, it should be considered to look to different ways to audit your software instead of CVEs. It was already unmanageable before AI, now it is impossible to triage.
Yes.
There will be at least ONE critical CVE every week.
> This page ships no JavaScript
Would be more convincing if the page didn't have JavaScript.
To be fair, I think that's cloudflare injecting those trackers, so Claude technically didn't ship any javascript.
I don't seem to get any javascript inserted.
Opening the dev console in Safari and Chrome, there's an injected https://static.cloudflareinsights.com/beacon.min.js tag at the very end of the body. If I curl the site, it's not injected, but if I copy as cURL from Chrome's dev tools and run that curl command, the script is injected again.
I feel that LLM-assisted writing really undercuts the point of what is ostensibly a cri du coeur...
This message brought to you by the NSA. Please do not patch your systems.
It's ok, the more companies have airgap systems the better.
The CVE will continue until the morale improves
> I patched on Monday. Tuesday was Patch Tuesday. Wednesday was Exploit Wednesday, because somebody read Tuesday’s diff.
Claude wrote this. And you can tell nobody actually read carefully, because it couldn't even get three items into a list without saying something incongruous (if somebody "read Tuesday's diff", that's Tuesday's CVE, not a new one on Wednesday, the thing being complained about).
https://www.pangram.com/history/3b7a78c1-a76e-4a93-8eef-7aee...
There's some irony in releasing a wholly AI-generated page with a lack of attention to detail to complain about the AI-induced security catastrophe stemming from a lack of attention to detail.
You're nitpicking. It's a week of security related work. It makes sense. The idea is that people dealing with new issues need a break - doesn't matter when the cve was assigned.