Re: CVE for hosted services

[jericho <jericho@attrition.org>]

On Wed, 22 Feb 2017, Pascal Meunier wrote:

: I'm afraid that the description of the entries, for issues on 
services 
: like facebook.com, would be typically very vague and unverifiable.  
I'm 
: rather annoyed by existing entries that read like "a problem in X, 
but 
: different from CVE-1234-5678 and CVE-1234-7890".  What is the issue? 
: What lessons could be learned from this?  What should we teach not to 
: do, or teach to do better?  No idea.

Good point.

Also consider that such descriptions would almost never carry version 
information and be based more on *approximate* dates. We often hear 
Facebook "fixed a vuln" but days or weeks after it really happened. 
Since 
versions are a huge tool for determining potential duplicate issues, 
without that would be painful.

.b