Security debt is piling up in the boring layers

The Linux kernel disclosed 1,313 vulnerabilities in one batch. Commenters noted that nearly every kernel bug gets a CVE by default now, and that most had no CVSS score yet, though many of the scored ones were above 7.0. In another thread, a post argued that Git 3.0's planned SHA-256 default will be a costly mistake. A forge operator said dealing with the SHA-1 and SHA-256 split is already painful and wondered how GitHub will cope. Researchers also found hidden software-defined radio capabilities in ESP32 chips, an undocumented feature that lets firmware capture raw baseband samples. And a study of connected cars found automakers mostly shifted blame to consumers, with Honda a notable exception.

The pattern: the foundational pieces, the kernel, version control, cheap wireless chips and cars, carry hidden surface area that nobody budgeted for. CVE counts become noise when everything gets one, and migrations like Git's hash change create years of two-world compatibility pain. One commenter drives a GR Corolla with the data module fuse pulled. That is the consumer version of the same distrust.

Older threads in the batch, like the FCC commissioner's IoT update proposal, show the same debate about who owns security updates has been going on for years without a clean answer.