HackerPapers

arXiv:0904.4058cs.CR

Security impact ratings considered harmful

Jeff Arnold, Tim Abbott, Waseem Daher, Gregory Price, Nelson Elhage, Geoffrey Thomas, Anders Kaseorg

Early discovery. Linked by one identifiable commenter. This paper is outside the main ranking; a mention is not an endorsement.

Abstract

In this paper, we question the common practice of assigning security impact ratings to OS updates. Specifically, we present evidence that ranking updates by their perceived security importance, in order to defer applying some updates, exposes systems to significant risk. We argue that OS vendors and security groups should not focus on security updates to the detriment of other updates, but should instead seek update technologies that make it feasible to distribute updates for all disclosed OS bugs in a timely manner.

arXiv comments
HotOS 2009
Journal reference
DOI
Subjects
cs.CRCryptography and Security

On Hacker News

Linked by 1 identifiable commenter in 4 comments across 4 threads, from May 2019 to Dec 2020.

Comments linking this paper, per year.

Discussed in comments4 threads

  1. Rocky Linux: A CentOS replacement by the CentOS founder 1 comment

    • Debian eLTS offers 7 years: https://wiki.debian.org/LTS/Extended That said, if you're really in the position of depending on a free project for over five years of security support, you probably will be totally fine with just ignoring the fact it's out of support. Just keep…

      geofftView on HNParent context

  2. CVSS v3 Creates New Challenges For Developers (2018) 1 comment

    • In 2009 some classmates and I wrote a paper called "Security Impact Ratings Considered Harmful": https://arxiv.org/pdf/0904.4058.pdf The position is that using CVSS to decide which updates to take is a losing gamble. You don't have a good idea in advance of how easily something…

      geofftView on HNParent context

  3. PEP 594 – Removing dead batteries from Python's standard library 1 comment

    • > As a security engineer, I like having a core team and a standard library in place that has gone through a long mature process with experienced developers, instead of someone who just git pushes code every night. This is an appealing sentiment, but you will get hacked if you…

      geofftView on HNParent context

  4. Red Hat Enterprise Linux 8 released 1 comment

    • It doesn't generate more secure code—as you say, patches themselves may have bugs, and way fewer people are looking at the patched branches. Active development happens on HEAD, and dodgy code is often rewritten before anyone goes actually looking for bugs (security or…

      geofftView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.