Hacker News new | ask | show | jobs
by nirui 37 days ago
How about this: a "vulnerability" is a "vulnerability", but after it was identified and verified to cause problem, that's when it should be called a "bug", because it could make the software do unwanted things.
3 comments
sfink 37 days ago
At Mozilla, everything is called a bug. It's what other systems call an "issue". So it's too late for your terminology at Mozilla. (Example: I have a bug to improve the HTML output of my static analysis tool. There is nothing incorrect or flawed about the current output.)

At Mozilla, but not everywhere: exploits are a subset of vulnerabilities are a subset of bugs.

link
freedomben 37 days ago
Fwiw i think this is right. A bug is anything that doesn't do what you want it to do, and nobody should want a vulnerability in their software
link
darkwater 37 days ago
That's why they created Bugzilla :) (https://www.bugzilla.org/blog/2023/08/26/bugzilla-celebrates...)
link
Yoric 37 days ago
When I worked at Mozilla, _everything_ was called a bug, whether it was a software issue, a problem in the office or some paperwork missing.

Much as GitHub calls everything an "issue" and GitLab a "work item".

link
cassianoleal 35 days ago
How is a vulnerability not a bug? Surely you didn’t design the software to enable exploits on your users, right?

Vulnerabilities are a special class of bugs. One that’s generally so important to fix that they get a special name and more attention.

That doesn’t make them less of a bug. It makes them more of one.

link