Re: "Local" and "Remote" considered insufficient

[Florian Weimer <fw () deneb enyo de>]

Ejovi Nuwere wrote:

> To summarize a vurnerability in one line is always difficult, more so 
> when you are writting in a language other then your native tongue. Your 
> ideas might help eleviate some of those troubles but not the core, in 
> addition to language issues, most security researchers are simply poor 
> writers. All of the complexities you detailed are very real, that is why 
> there needs to be a simplified terminology.

In this case, I'd assume it's the responsiblity of the vendors to hire
people who improve the quality of security advisories.

> While Local and Remote alone are clearly not enough, Local, Remote, 
> Remote Level 1, Remote Beta and Remote Delta will not help either.

You need not restrict yourself to these signal words.  While it's common
to write just three lines about a vulnerability, nobody (well, except
your legal department) forces you to be so terse.

> The idea of Local, Remote, and Remote Authenticated sounds nice and I 
> would love to see more researchers adhere to this phrasing or something 
> similar to the risk catagories vurnerability scanners use. Low, Medium 
> and High, three classifications, then let the end user sort them out.

Risk assessment is something that has to be done locally because it is
greatly affected by local implementation decisions and the threats you
face.