Discussion
now that mitre's basically gone, the concept of a CVSS score is worthless.
every fucking idiot red teamer is slinging slop they clepe as a 9.8
which gets everyone fucking panicked
and then six days later it turns out to be a 5.6, but by that time the slop patch has already landed and fucked up something entirely other.
panic is a fucking threat surface and I'm fucking well and truly over and done with the fucking ego-fellating red team dipshits filing crap so inflated it belongs in its own e621 category.
@munin “Panic is a threat surface” is such a brilliant way to put this.
Definitely has applications beyond infosec as well (political ragebait comes to mind).
@munin Implementing CVSS5, it is basically CVSS4 but has a final score anti-slopping multiplier that does pre-emptive decrease in score