This template is within the scope of WikiProject Computer Security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer SecurityWikipedia:WikiProject Computer SecurityTemplate:WikiProject Computer SecurityComputer Security
This template is within the scope of WikiProject Internet culture, a collaborative effort to improve the coverage of internet culture on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Internet cultureWikipedia:WikiProject Internet cultureTemplate:WikiProject Internet cultureInternet culture
This template is within the scope of WikiProject Years, a collaborative effort to improve the coverage of Years on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.YearsWikipedia:WikiProject YearsTemplate:WikiProject YearsYears
Why does this template automatically categorize pages that transclude it? (the includeonly statement with {{main other}} placed within in) That seems against the practices of not categorizing pages that translcude navbox templates, since those navboxes may appear on pages outside the scope of the category. The categories should be directly placed into the pages themselves to make it obvious they are being categorized, instead of making it difficult to determine why something is being categorized. -- 67.70.35.44 (talk) 22:27, 23 December 2014 (UTC)[reply]
Date: which to use? (Date of public disclosure? Date of discovery?)
@A5b: KRACK was actually discovered in 2016, and notified to vendors by mid-2017. It was not publicly disclosed until October 2017.[1] So, your edit seems a bit inappropriate. Any comment, or OK for me to revert? Please WP:PING me if you reply. Thanks! Zazpot (talk) 01:42, 17 October 2017 (UTC)[reply]
Zazpot (talk·contribs), source says "Vanhoef discovered the issue in 2016 but kept working to refine his attack. The researcher sent notifications to some affected vendors in July 2017, and US-CERT sent a broader note to more vendors at the end of August." - so its CVE is 2017-*. Some other attacks listed in the template may be in process of discovering years earlier than published. Which date should we use - date of idea, date of ID reservation or date of wide/open publication? Which date will be more useful for readers: 2016 or nov. 2017 (wide discussion of the attack is in 2017, not in 2016)? What about security holes used by years by some governments to do their targeted attacks, and later rediscovered by open community, like ... for early reports of Heartbleed#Possible_prior_knowledge_and_exploitation (2012 vs 2014) and kleptographic backdoors Dual_EC_DRBG? Or EternalBlue with public release in 2017 is marked as 2017 in the template, not by some unknown year of introduction to Agency's software inplant catalog. `a5b (talk) 02:15, 17 October 2017 (UTC)[reply]
@A5b: fair points. However, the relevant row of the template is headed "Vulnerabilities discovered". As such, the year given should refer to the (first verifiably known) date of discovery, not the date of public disclosure. That said, I would be in favour of renaming the row to "Vulnerabilities publicly disclosed" or "Major vulnerabilities publicly disclosed", since that is effectively what it contains. If we did that, then I would agree with you that the correct date to use would be the date of public disclosure. Sound reasonable? Zazpot (talk) 02:43, 17 October 2017 (UTC)[reply]
Zazpot (talk·contribs), the other date is the date of CVE registration - some things are discussed for time with vendor before fully public release. But the date of public disclosure is probably more relevant to the readers; it will be close to the dates of fix released which may be useful too. (And more work is needed with the KRACK article itself, to add what to fix and what will be never fixed like millions of older/cheaper androids). `a5b (talk) 03:05, 17 October 2017 (UTC)[reply]
@A5b: understood about CVE, but I agree date of public disclosure is likely most relevant (and comprehensible) to readers. Just so I'm clear, would you support changing the row header to "Vulnerabilities publicly disclosed" or "Major vulnerabilities publicly disclosed"? If so, which of those do you think would be best? Thanks again, Zazpot (talk) 03:27, 17 October 2017 (UTC)[reply]
CVE is better than something like author remember when he found errors in the protocol and says the date in some interview (full attack may be not created at the time of initial flaw detection); CVE is allocated by/with vendor; it can be closer to date of fix releasing, and it is clearly visible. But it has no month/days in the number itself (does NVD / MITRE list allocation date?). I think we should sort "Vulnerabilities publicly disclosed" by date of the CVE or by date of public disclosure. And lists require not only active marketing (like it was with dirty cows and other recent holes after Heartbleed with cute logo, personal website, interviews with non-computer press - ref http://www.kalzumeus.com/2014/04/09/what-heartbleed-can-teach-the-oss-community-about-marketing/ 'very emotionally evocative' etc); it needs some reliable source with impact estimation. Is there List of Major Computer Vulnerabilities by Year (by Decade)? (There is single Timeline of computer security hacker history for 2 centuries; there are many List of vulnerable fishes/plants/species, but not lists of vulnerable softwares. And databases like CVE have more than 1000 ids per year; less than percent is successfully marketed to the public). Should the list in template be filtered with CVSS or by millions of users/devices/sites affected or best marketing? `a5b (talk) 03:45, 17 October 2017 (UTC)[reply]
@Zazpot: Definitely should be put here. Not sure whether to put it in 2018 (when it was first reported) or 2015 (when it began). I'll put it in 2018 for now --WuTang94 (talk) 23:01, 10 February 2019 (UTC)[reply]
@FallingGravity:Good point. With that being said, how is the FB/Cambridge Analytica incident any different than a data leak or vulnerability discovered by a hacker? (Ex. Exactis or Trustico) It's currently unknown if these vulnerabilities were exploited by malicious parties before they were fixed. --WuTang94 (talk) 21:31, 11 February 2019 (UTC)[reply]
2018 Russian cyberattacks on Porton Down and the Organisation for the Prohibition of Chemical Weapons
