Explains how machine-readable VEX (Vulnerability Exploitability eXchange) statements can be used to scale vulnerability triage by encoding whether a given system is actually exposed to a reported CVE. It contrasts naive SBOM-based scanning (syft + grype) that produces many matches - including Go module alerts like GO-2026-5970/6629 - against language-aware reachability analysis (govulncheck) that can show a program does not call vulnerable symbols. It then shows the harder case of whole operating-system images: a Debian-based container yields hundreds of vulnerability hits, and manual triage of a single CVE (CVE-2007-2768, an sshd/PAM opie timing/info leak) requires checking sshd settings, keyboard-interactive auth, and whether an opie PAM module is present - work that is tedious to repeat on every change.
Demonstrates that NixOS makes this repeatable and automatable by codifying system configuration and package composition so conditional VEX statements can be generated from the Nix build. Using sbomnix to produce an SBOM, a Nix expression can evaluate conditions (absence of opie package, KbdInteractiveAuthentication == false, no PAM opie rules) and emit a vex.json with status "not_affected" and justification "vulnerable_code_not_present." Integrating that VEX into grype reduces triaged matches (e.g., drops the specific CVE), and the author has open-sourced nixos-vex while noting it should not be treated as a high-trust data source yet.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Elon Musk's ownership of X has led to increased activity from prominent figures, despite his controversial actions and statements. Musk has repeatedly made offensive remarks, including antisemitic comments and deadnaming his trans daughter, which tarnish his reputation. (lexontech.org)
Ukrainian drone strikes have disabled multiple Russian Google data centers, disrupting disinformation bot traffic. The strikes are part of Ukraine's intensified efforts to target Russian digital infrastructure in response to Moscow's attacks on Kyiv. (tomshardware.com)
Dentists perform procedures based on their expertise, but their confidence can sometimes lead to unnecessary or harmful treatments, as shown in a personal account of dental interventions. The narrative highlights concerns about whether dental professionals always act in patients' best interests and the potential for over-treatment. (mapwriting.substack.com)
Homebutler is a server monitoring tool that reports only significant changes, reducing unnecessary alerts. It is a single Go binary with no database, designed for simplicity and efficiency. (github.com)
Iran threatens to cut undersea cables in the Strait of Hormuz, risking disruption to global data traffic and economic stability. The cables are vital for international communications, financial transactions, and technology operations worldwide. (theconversation.com)
The Trump administration temporarily banned Microsoft and other tech companies from sponsoring foreign workers for US permanent residency, citing abuse of immigration rules. Microsoft disputes the claim, asserting most of its US employees are American, while the ban has caused diplomatic tensions with India. (arstechnica.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.