1

Does there exist consensus on having (or not having) tags for individual high-profile critical vulnerabilities? While Heartbleed was not directly Unix-related, Shellshock is (it occurs in bash).

  • 3
    This is a yes/no question: yes consensus exists, or no consensus does not exists. Would you not rather be interested in what the consensus is if there is any, and what the arguments and opinions are if there isn't? – Anthon Sep 25 '14 at 7:59
8

Is the meaning of the tag clear from the name? Yes.
Is the tag name discoverable from the desired meaning? Yes.
Does the tag name designate a topic that is related to the scope of the site? Yes.

A tag that passes these fundamental tests is not particularly harmful.

In order to be useful, tags need to be applied consistently. This is a strong form of the discoverability test: do people think of using the tag name often enough? Experience from Heartbleed and Shellshock suggests that the answer is yes.

Does the tag delineate an area of expertise? No, not really.
Does the tag represent a concept that some users will specifically want to avoid? No.
Is the tag useful to guide searches? Not really: the name of the vulnerability is likely to be in the question body anyway. This would be different for vulnerabilities with a name that has other meanings, like Beast and Crime.

So there's not much value in having these tags, but on the other hand they don't hurt either. They are useful to identify duplicates more quickly, but it's true that this is mostly important in the early days of the publicization of the vulnerability.

My conclusion is that I might not create the tag, but if someone bothers to tag the relevant questions with it, I'm not going to remove it.

4

Critical vulnerabilities are (hopefully) short lived problems that might peak for a week or two and then will unlikely have new questions, once fixes have been rolled out.

If you look at tag definition help, it says something about that the definition should help apply the tag to a question, for me that indirectly implies that if the tag is unlikely to be going to be applied to new questions, it has lost a significant amount of usefulness.

Separate tags for each vulnerability are IMHO not necessary. A generic 'vulnerability' tag is more useful, just like we don't (want to) have a separate tag for each and every release for a particular Linux distribution.

  • A) Will those tags be of historical interest? B) Can the tags be burninated after the fad passes but be preserved for the duration of the "crisis"? It seems that users looking for heartbleed and shellshock will find the corresponding corpus of know-how faster with a tag than without it. – Deer Hunter Sep 25 '14 at 9:50
  • 2
    @DeerHunter I'm not a great tag user myself, neither applying them when editing, nor using them while searching. IMHO if you have such specific information like the name of a vulnerability it is as trivial to find information on Stack Exchange about it with or without the tag. But I am mostly concerned with tag namespace pollution, so burninating afterwards would be an alternative. – Anthon Sep 25 '14 at 10:23
  • 1
    vulnerability isn't really a specific area under security. I don't understand the connection with tags about a version of a distribution: these have a fundamental defect that they get used a lot on questions that are not in fact about that version of that distribution. We don't get a huge influx of questions tagged heartbleed that are about security vulnerabilities in general. – Gilles Sep 25 '14 at 11:59
  • 1
    @gilles I made the parallel with versions of a distribution as I was under the impression that a generic "Debian" was preferred over the use of "Etch", "Wheezy", etc. and thus "vulnerability" over "heartbleed" & "shellshock". As always parallels only go so far and as I indicated, I am not a great tag-user. – Anthon Sep 25 '14 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .