Ramblings of an aging IT geek
← Ramblings of an aging IT geek
news

when a bug needs branding before i'll take it seriously

A short grumble about the way serious vulnerabilities now arrive with a name, a logo and a marketing site, and whether that helps anyone actually patch.

A stylised tech-news graphic of the kind that accompanies a named vulnerability

It is January, the patch treadmill is back up to speed, and I spent part of this morning reading the usual round of advisories. Somewhere in there was yet another vulnerability with a name, a logo, and its own little website. I will not pretend I can keep the recent ones straight without looking them up, which is rather the point.

I understand how we got here. Heartbleed had a logo and a memorable name, and it genuinely got patched faster because of it. A CVE number is the sort of thing that gets filed under "later". A bleeding heart on the morning news is the sort of thing that gets a board asking the CISO awkward questions by lunchtime. Branding works.

But it has curdled a bit. Now every moderate-severity issue arrives dressed up like it might end civilisation, and the actual signal (is this remote, is it pre-auth, is it being exploited in the wild) is buried under the press kit. I find myself doing more work, not less, to decide whether to drop everything. The logo tells me nothing. The CVSS vector and a sober paragraph about exploitability tell me everything, and those are increasingly the hard part to find.

So my unglamorous workflow stays the same. Ignore the artwork, read the advisory, check the affected versions against what we actually run, and patch on the merits. If the marketing site happens to host a clear technical write-up underneath the logo, fine, I will take it. But I am not patching faster because someone commissioned a typeface.