Damn, dunno why I've always assumed that if something gets a CVE, then some authority has reproduced and verified it.

Shouldn't it be CNA's job? Why would anything get a number if it hadn't been verified?

The current system is radically overwhelmed and has been seeing cuts over the last few years.

> then some authority has reproduced and verified it.

No, the system puts a lot of trust into the submitter.

It's really just a number allocation and that's all. You can get a number. That doesn't mean the number refers to something useful.

And it makes sense. If you publish some state-of-the-art algorithm then you're basically helping your competition, and you don't get anything back from them. So you publish bare minimum in small articles on your website, only to gain people's/investors' interest, and just hope that you didn't share too much. And it'll always be like that, unless the root cause changes - intentives. And the main incentives right now are money and power.

You know also what was the biggest help for these companies? All the data they scrapped from the internet, the books they torrented, the open source projects whose licenses they did not respect.

The least these companies can do is to publish everything they own

> The least these companies can do is to publish everything they own

Well, being able to talk to superintelligent all-knowing savant 24/7 on your phone for $20 a month is also something

You people really have rotten morals

Well if it's moral for gatekeepers of talent to hoard immense intellectual rights to be protected by the violence of the state, then I'm immoral in that sense. Information wants to be free

> Information wants to be free

Only ever said by people who have never put in the effort to create any information of value.

What other incentives can you imagine for Homo Sapiens?

Well... I can image incentives like health/survival/independence in case of war or other cataclysm. But this is pretty drastic, nothing else comes to mind though

Glory and altruism

People only care about those because it brings them more resources.

People seek glory for power. Altruism is not a stable strategy so will be exploited.

Trivially disproved by self-sacrifice in the persual of both

self-sacrifice often brings resources to your kin, and is also easily exploitable

I wonder how many of you guys actually read this kind of reports (or even skim through)? At the first glance it looks to me like someone just asked an agent for a security review of this CLI and then pasted results to the gist.

When I see a report like that I just assume it's a low-effort AI slop and stop reading immediately. Why would I read it since I can do the same with my agent and with that understand it better? Or if I'm really lazy then just copy paste this report and ask for a summary or have a discussion.

Please tell me then how ridiculous my post is. I wanna hear that - that's why I posted this. Your comment did literally nothing useful except bumping your own ego.

> You literally did not take 5 minutes to even start Yes you're exactly right - you can guess that from reading my post. But you're hitting the wrong topic there. Seems like you didn't understand what I asked.

But let me elaborate on that. Why would I take >5 minutes to start reading each report I see on the web? Like all humans I have limited capacity of information I can effectively gather so I'm not gonna start reading each article 24/7.

Topic was interesting, got many upvotes, so I opened the report. I saw there a bunch of LLM-generated paragraphs, got mixed feelings and just closed it. I mean just see the beginning "A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so explicitly.". When I see something like that I immediately lose motivation to read that.