[Avamander]

> The environment where we write critical code the way we do now is very wrong. It's actually not that easy to figure out if something is exploitable or not.

Then the correct approach is not to cause "CVE fatigue" that can cause significant second-order effects. Not to mention the fact that who else is better suited to make that assessment? It's unavoidable that an assessment still has to be made because fundamentally there are use-cases where touching a working system has to have a really good reason. This will result in actually important things not getting patched because not-kernel-experts had to make that decision.

I also can't imagine large vendors being forced to follow a significantly more frequent update cadence also choosing to retain their current level of QA. Best case we're going to get more frequent less tested updates, worst case we're going to deploy an actual vulnerability due to some low-importance bugfix (with an assigned CVE).

[mnau]

CVE is just a identifier. CVSS should assign a score.

I would require all CVE to ha attached exploit demo code. Otherwise it's shouldn't be CVE