廉价发现之后：从未知到已知且未修复
After Cheap Discovery: From unknown to known-and-unfixed
AI总结：
本文针对软件漏洞暴露风险问题，提出发布决策时的修复覆盖率才是决定因素，分析相关论证并指出需测量发布覆盖率以推动责任等机制发挥作用。
AI中文摘要：
自动化漏洞发现已消除了曾保护多数软件的专家注意力稀缺问题。此前应对措施集中于漏洞发现与修复，且两者成本正不断降低。本文指出，成本曲线均不决定软件暴露风险，决定因素是发布决策时的修复覆盖率：即产品发布前已修复的已识别漏洞比例，以及组织决定随产品发布的已知、已评估、未修复漏洞残留量。本文提出四点论证：其一，该残留并非已发现漏洞的随机样本，因为漏洞分类依据成本排序，高成本案例属于架构类；其二，延迟积压本身是高价值产物；其三，已记录的漏洞知晓情况会改变组织的法律与市场地位，产生软件价格无法反映的逆向选择；其四，针对供应商的监管工具均不针对内部知识，仅在第三方观测到漏洞利用时触发，导致供应商所知与需披露内容间的差距完全由供应商自行决定。本文以CISA的《26-04号约束性运营指令》为例，说明解决方案所需条件，指出当前未测量发布覆盖率，而测量该指标是责任、保险或采购发挥作用的前提。
英文摘要：
Automated vulnerability discovery has removed the scarcity of expert attention that protected most software. The response has concentrated on discovery and on repair, and both are becoming cheaper. This article argues that neither cost curve determines exposure. What determines it is remediation coverage at the release decision: the fraction of identified vulnerabilities fixed before a product ships, and the residue of known, assessed, unremediated flaws an organisation has decided to ship with. Four arguments follow. The residue is not a random sample of what was found, because triage sorts on cost and the expensive cases are architectural. The deferred backlog is itself a high-value artifact. Documented awareness alters an organisation's legal and market position, and produces an adverse selection that the price of software does not reflect. And no regulatory instrument reaching vendors triggers on internal knowledge - every one fires on exploitation observed by a third party - which leaves the distance between what a vendor knows and what it must disclose entirely at the vendor's discretion. CISA's Binding Operational Directive 26-04 is examined as the exception that shows what a solution requires: a regulator's reach over a decision is bounded by its visibility of the input to that decision, so a duty attaching to internal knowledge needs an independent record of that knowledge to attach to. Release coverage is not currently measured, and measuring it is the precondition for liability, insurance or procurement to act.
