[TheDong]

> so is still a bug and should still get a CVE

It's a bug, sure. The V in CVE is for "vulnerability", which is why people treat CVEs as more than just bugs.

If every bug got a CVE, practically every commit would get one and they'd be even less useful than they are now.

At that point, why not just use commit hashes for CVEs and get rid of the system entirely if we're going to say every bug should get a CVE?

> Re: Harassment - Can't the project release a statement saying that the bug writeup is low quality and unable to be reproduced?

If your suggested response to a human DoS is "why can't the humans just do more work and write more difficult-to-word-correctly communication", then you're not understanding the problem.

[quacksilver]

If you are wasting time wording communication then are you doing it wrong?

I imagine the response would be looking at it briefly, seeing if it looks dangerous or reproducible and getting an AI to return a templated "PoC or GTFO" response.

The mere existence of a CVE doesn't tell anyone whether a bug is valid or not, and the security reports should be handled in the same way regardless of whether one does exist. For some odd reason people have attached value to having your name logged beside CVEs, despite it not telling you anything,

[TheDong]

"human communication is easy, just have an AI say 'buzz off' and the conversation partner and other strangers will always respond respectfully, I don't know why so many people complain about lack of spoons or other social issues".

Thanks doctor, you just solved my anxiety.

I broadly agree that having templates does lower the amount of human effort and emotional labor required, but trust me, it's not a silver bullet, even hitting someone with a template takes spoons.

I don't really care that CVEs in theory are apparently entirely without meaning and created for nonexistent bugs, we're talking about the reality of how they're perceived and used.

Like, I'm saying "Issuing garbage such that 100 people have to read it and then figure out what to do is bad, we should instead have a higher bar for the initial issuing part so 1 or 2 people have to actually read it, and 100 people can save some time. We should call out issuing garbage as bad behavior to hopefully reduce it in the future".

You're apparently disagreeing with that and saying "But reading is easy, and the thing is meaningless anyway so this real harm that actually happens is totally fine. We should keep issuing as much garbage as we can, the numbers don't mean anything. It's better to make a pile of garbage and stress the entire system such that no one values or trusts it than to add any amount of vetting or criticism over creating garbage"

idk, I guess we're probably actually on the same page and you're just arguing for arguing's sake because you think you can be a pedant and be technically correct about CVEs. Tell me if I got a wrong read there and you have a more concrete point I'm missing?

[tptacek]

But that's not what happened here. These are memory corruption bugs. Probably not meaningful ones, but in the subset of bugs that are generally considered vulnerabilities.

[TheDong]

It's more complicated than that though. For security, the whole context has to be considered.

Like for example, look at the linked CVE-2025-12200, "NULL pointer dereference parsing config file"...

Please, explain a single dnsmasq setup where someone is somehow constructing a config file such that it both takes in untrusted input where this NPE is the difference between it being secure and being DoSd or insecure somehow, if you can even conjure up a plausible hypothetical way this could happen, I'd love to hear it, because this just seems so impossible to me.

This seems firmly in the realm of issuing CVEs for "post quantum crypto may not be safe from unknown alien attacks"

[ruined]

CVE-2025-1312 bash and sudo privilege escalation

sudo may be exploited to obtain full root privilege when the shell receives attacker-controlled input

to reproduce: execute this shell script and authorize sudo when prompted