Why a CVSS threshold alone is not enough to filter vulnerability alerts reliably

·1 views

A developer running a vulnerability write-up site built an automated triage script that pulls CVEs daily from two sources: NIST's NVD, filtered to CVSS scores of 7.0 and above, and CISA's KEV catalog, included in full regardless of score. The two sources were kept separate by design, as KEV confirms active exploitation while CVSS only predicts potential severity — merging them caused lower-scored but actively exploited bugs to be overlooked. A critical flaw emerged when failed data fetches and genuinely quiet days both returned zero results, making a broken pipeline indistinguishable from a clean one. The fix involved collecting errors explicitly and setting a non-zero exit code whenever a fetch failed, so callers could tell a truly empty result from a silent failure. The lesson is that a filtering threshold is incomplete until the system can distinguish between 'nothing found' and 'nothing was even checked.'

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds workaround to trace slow queries inside Snowflake stored procedures

A developer found that Snowflake's ACCOUNT_USAGE.QUERY_HISTORY table lacks a PARENT_QUERY_ID column, making it impossible to directly link child statements to their parent stored procedure call. To work around this, they devised a SQL correlation technique using SESSION_ID and timestamp containment, selecting the tightest enclosing query window to reconstruct parent-child relationships. The approach was validated against edge cases including nested procedures, concurrent sessions, and rapid back-to-back calls, all of which produced clean, reliable results. Building on this, the developer created three diagnostic stored procedures to bulk-scan for regressions, drill into per-operator query profiles, and optionally request an AI-generated analysis via Snowflake Cortex. The tooling is designed to run under owner's rights, requiring only a one-time GRANT on ACCOUNT_USAGE to function across customer environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Step-by-Step Guide to Building and Sharing Custom Docker Images

Custom Docker images allow development teams to standardize application environments by bundling specific OS versions, dependencies, and code into a single shareable unit. A practical approach involves first running all setup commands manually on a clean Linux system before translating them into a Dockerfile. The tutorial demonstrates building an image that runs a Flask web application on Ubuntu 24.04, including creating a Python virtual environment to comply with the OS's managed environment policy. A Dockerfile is then used to automate these steps, enabling the image to be built, run, and distributed consistently across any machine. Making the final image publicly available ensures all team members can pull and use the same environment, eliminating dependency conflicts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Polite Web Crawler With Rate Limiting Across Node Cluster Workers

A developer built a small search engine from scratch, including a web crawler, an inverted index in MongoDB, and a BM25 ranker, to understand how such systems work internally. The initial crawler version lacked rate limiting and ignored robots.txt, meaning it would aggressively hammer web servers it encountered. To fix this, the developer implemented politeness controls, but discovered that rate limiting across Node.js cluster workers is a concurrency problem, not just a parsing one — and got it wrong twice before finding a correct solution. The key insight was that broken politeness features produce no errors on the crawler's side; only the targeted server experiences the impact as hostile behavior. The developer recommends testing by asserting what the remote server actually received, rather than relying solely on what the local code returns, and notes the full implementation is publicly available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a stale hardcoded counter silently killed a registration button via a timing bug

A developer debugging a broken registration button on a credits platform traced the issue to a single uncaught TypeError, not a missing function. A live-stats helper added to replace a stale hardcoded service count was running at page load and attempting to update a DOM element that only exists after a successful registration. The null reference threw an error that crashed the entire inline script block before the doRegister function could be defined, leaving the button's onclick handler with nothing to call. The root cause was a timing mismatch: code executing at page load was writing to an element born only at runtime. The fix involved adding null guards to every DOM lookup, ensuring the live count update is also triggered after registration succeeds, and removing the stale hardcoded value entirely.

0 comments Read more at DEV Community