Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Thursday February 28 2019, @02:55PM   Printer-friendly
from the hello-entropy dept.

The National Vulnerability Database (NVD) is a US government-funded resource that does exactly what the name implies-acts as a database of vulnerabilities in software. It operates as a superset of the Common Vulnerabilities and Exposures (CVE) system, operated by the non-profit Mitre Corporation, with additional government funding. For years, it has been good enough—while any organization or process has room to be made more efficient, curating a database of software vulnerabilities reported through crowdsourcing is a challenging undertaking.

Risk Based Security, the private operator of competing database VulnDB, aired their grievances with the public CVE/NVD system in their 2018 Vulnerability Trends report, released Wednesday, with charged conclusions including "there is fertile grounds for attorneys and regulators to argue negligence if CVE/NVD is the only source of vulnerability intelligence being used by your organization," and "organizations are getting late and at times unreliable vulnerability information from these two sources, along with significant gaps in coverage." This criticism is neither imaginative, nor unexpected from a privately-owned competitor attempting to justify their product.

In fairness to Risk Based Security, there is a known time delay in CVSS scoring, though they overstate the severity of the problem, as an (empirical) research report finds that "there is no reason to suspect that information for severe vulnerabilities would tend to arrive later (or earlier) than information for mundane vulnerabilities."

https://www.techrepublic.com/article/software-vulnerabilities-are-becoming-more-numerous-less-understood/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by c0lo on Friday March 01 2019, @01:51AM (5 children)

    by c0lo (156) Subscriber Badge on Friday March 01 2019, @01:51AM (#808510) Journal

    We are very close to having one: Malbolge.

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by DannyB on Friday March 01 2019, @03:22PM (4 children)

    by DannyB (5839) Subscriber Badge on Friday March 01 2019, @03:22PM (#808710) Journal

    We already had it: BASIC in 4K ROM

    All possible programing problems from computer algebra systems, to theorem proving, to advanced compilers, natural language processing; these all can be solved with BASIC.

    --
    To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
    • (Score: 2) by c0lo on Saturday March 02 2019, @02:44AM (3 children)

      by c0lo (156) Subscriber Badge on Saturday March 02 2019, @02:44AM (#809044) Journal

      Is it so?
      Then write a BASIC program that demonstrates that P = NP

      --
      https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
      • (Score: 2) by DannyB on Monday March 04 2019, @03:00PM (2 children)

        by DannyB (5839) Subscriber Badge on Monday March 04 2019, @03:00PM (#809782) Journal

        What I'm suggesting is that any program that does what you suggest can most certainly be implemented in BASIC. It's a facetious argument against using languages which are too low level for the purpose. Any existing theorem proving programs can be implemented in BASIC. You would first need to implement dynamic memory management with a heap (in an array) and then GC in order to build something like a theorem prover. You would probably even need to implement a lisp and then a Prolog or Haskell on top of that.

        --
        To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
        • (Score: 2) by c0lo on Monday March 04 2019, @10:47PM (1 child)

          by c0lo (156) Subscriber Badge on Monday March 04 2019, @10:47PM (#810017) Journal

          In 4k ROM, yeah.

          Look, CS-wise, I know Basic is Turing-complete, I'm being facetious when it comes to engineering aspects of it.

          --
          https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
          • (Score: 2) by DannyB on Tuesday March 05 2019, @12:04AM

            by DannyB (5839) Subscriber Badge on Tuesday March 05 2019, @12:04AM (#810058) Journal

            Yeah, 4K ROM. As long as it is Turing complete, you can implement whatever you want on top of it as long as you have enough memory available. As I said you could build a malloc / free type allocator with an array as the heap. You could build some kind of bytecode machine. You could build GC, etc.

            The ROM doesn't need to be big, just the RAM needs to be adequate for your multi-terabyte Java heap hello world application.

            --
            To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.