Hacker News

points by 0xcrypto 21 hours ago | 0 comments

Can we stop vibecoding a new website for every next vulnerability we find please? Thank you.

Blame heartbleed for the practice, which long predates ChatGPT and vibecoding. Human psychology is to blame. Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.

[–] autoexec 21 hours ago

> Only nerds are going to find CVE-2014-0160 triggering, but if I say heartbleed everyone who was there remembers.

That has more to do with the severity of heartbleed than the fact that it had a name and a logo. I've since seen a lot of vulnerabilities try to market themselves with websites, cute names, and stupid logos but I still don't remember them because they still just weren't big enough to actually be memorable.

[–] cowlevel 12 hours ago

yes, the other day I remembered "that dirty page bug with AF_ALG" and apparently it's got a name, but I could've found its CVE number just as well

[–] rustyhancock 20 hours ago

I think it's a good idea when there is no CVE and a don't fix status.

Before this practice in general you simply released the exploit and see if enough chaos triggers a fix.

[–] exploderate 20 hours ago

If people can't be responsible, let's just create a mailing list, call it "full-disclosure" and post everything there.

[–] couchand 12 hours ago

For those following along at home: https://nmap.org/mailman/listinfo/fulldisclosure

[–] therealmarv 19 hours ago

why not? If you don't like it don't click it. Is not that the main purpose of the web that everybody can publish a web site?

[–] embedding-shape 17 hours ago

Well, to be fair, you don't know it is until after you've gotten there. But also to be fair the other way, you can just click the close tab and move on with your life. But again to the other side, it sucks when N% of HN articles end up being closed within 2 seconds as you realize the author spent about 4 seconds writing a prompt and is now asking you to spend 5 minutes reading what they likely didn't even review themselves before hitting publish.

A bit like the postal system. Yes, it's meant to send physical letters and what not to my home, but it still sucks when I get ads that just goes straight into the trash. Yes, you're using the system as intended, but I still consider your business slop if you send ads to me this way.

[–] MarkBlah 13 hours ago

Sounds like a you problem, I’m just sharing information that’ll hopefully force Google’s hand in fixing a bug.

[–] __m 21 hours ago

Why? I like the presentation.

[–] mirror_dude 10 hours ago

I hear that, but if the vendor closes as won't fix you don't really have another option to get the vendor to pay attention.

[–] xuhu 18 hours ago

Not if it helps raise awareness and gets companies to notice. Is peanutbutterjelly.co.uk more worthy of a domain ?

[–] tencentshill 8 hours ago

Putting up a website is as easy as writing a blog post now. Why wouldn't they?

[–] MarkBlah 20 hours ago

agreed, we should all use gopher and block all web traffic, go back to text based systems, use single threaded operating systems and use token ring NIC's

[–] AspireOne 19 hours ago

I'll be honest, I have no idea what gopher or ring NIC is, lol.

[–] MarkBlah 17 hours ago

Ah before www, gopher was used to try arrange information, similar to this page. Prior to that there were bbs’s where you dialed up to another computer.