Only 0.5% of 383,000 CVEs are ever exploited in real-world attacks

gnabgib

Title: What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks You've taken a link (the article does not make your title claim) and phrased it as a fact. > Yet only about 2,000 CVEs (roughly 0.5%) have been linked to real-world exploitation

nullpoint420

That we know of

fwlr

The other 99.5% are exploited on someone’s resume

personjerry

"Only 0.5% of doorways are used to leave with bank money" Look, I only need one doorway, I'm not coming back to prove all your doorways are usable. If you cover the obvious ones I'm going to use the less obvious ones. What a silly article.

jauntywundrkind

But man will people harp on an io-uring or KSMBd cve for years, decades. Even if no one suffers any consequences, the sense of wrongness, the zeal flew feel when we can point the finger: it's overpoweringly strong! Redox added ring buffers, and like 75% of the comments were attacks. https://news.ycombinator.com/item?id=50329288 You can be right in the time that something isn't quite ready. But generally these people don't ever stop their flamethrowering. Years latter, and there is still the same incindearies being thrown about. Even after things have proven great, even as they are massively expanding capabilities. Don't let conservatism into your heart, don't position yourself against progress. Have some willingness to allow things forwards. Thank you Yegge for Notes from the Mystery Machine Bus for helping impress this lesson on me long ago. Eventually the progressive types, if they aren't too encumbered by others, will usually find their will! The anti-willing though will steal as much oxygen as they can, the whole time. https://gist.github.com/cornchz/3313150