The Cry Wolf Vulnerability Paradox
summary
Shows measured claims not slogans: open source scanners hit 800 days to disclosure median for vuln discovery, teams report 25–75% perceived false positives, and the practical target is 2–5% false positive to avoid alert fatigue. Demonstrates concrete tooling: syntax-tree diffs plus ML fingerprinting to find patched functions, building call graphs and a Neo4j-style graph search to compute safe transitive-upgrade routes. Finds call graphs remain imprecise, remediation PRs merge ~65%, and deep analysis helps but costs time.
AI-written summary · about
chapters (14)
- 0:00Intro
- 2:07Alert fatigue is pit of wasted time
- 4:16You don't know the flaws you had one year ago
- 5:47Four levels of true positives
- 6:56Are you using the vulnerable package?
- 8:36Inaccurate translations between standards
- 9:45Stale data in advisories
- 12:31Optimizing for balance, tuning for precision
- 13:12Safe in a vulnerable context
- 13:54Can you reach the vulnerable code?
- 14:30Finding the vulnerable code in open source
- 16:23Determine reachability with call graphs
- 18:11Automated pull requests
- 21:24Breaking Changes
related talks
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
16mPerformance improvements: exposing hidden security fixes in Open Source
22mWhen is a vulnerability not a vulnerability? Overcoming the...
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
39mThe AI Arms Race in Vulnerability Management, Who’s Winning?
37mStranger Danger: Finding Security Vulnerabilities Before They Find You!
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis