Posted by mooreds 10 hours ago
Majority of researchers dont care how important the bug is, everyone wants something to put on CV, they get paid extra by companies to finding bugs in SAP or SalesForce that will never ever ever be used for anything.
Pointless moot just to generate noice. Like 90% of whole infosec sector.
At least thats what I understood from discussions with someone who has many nations security at stake at work.
Now - I am not saying I disagree with everything here, mind you; I guess everyone may agree that CVEs may range in severity. But then the question also is ... what is the point of an organisation that is cut down to, say, handle 1% of CVEs - and ignore the rest? Why have such an organisation then to begin with?
I don't have enough data to conclude anything, but from a superficial glance it kind of seems like trying to cut down on standards or efficiency.
https://shop.nist.gov/ccrz__ProductDetails?sku=2387
(The only problem with it is that it's backdoored the NSA.)
Who doesn't love a jar of Industrial Sludge?
I'm gunna call RFK right now and tell him to fix this!
That's kind of the norm in the current US administration, so it shouldn't be surprising.