Hacker News Reader

Most of the CVEs I have to deal on my $DAY_JOB are regular bugs, not security issues. Nowadays CVEs are like bitcoin mining but for the security folks.

View on HN

Completely agree. I get a lot of "CVEs" that are "test code has a hardcoded key" or similar. Once or twice a year I get a real CVE.

"Urgent critical vulnerability: SPF record on your domain allows soft-fail, do the needful and pay a bounty for our hard work"

"Critical: your Google Maps API key is visible in your web page as required."

Reply on news.ycombinator.com