October 2026 – Code Curmudgeon

The fish will die Picture the meeting where somebody designs an internet-connected thermometer for a fish tank. Someone asks what the risk is, and...

Definitioner

CVE

CVE stands for "Common vulnerabilities and exposures" and is a way to define a particular security vulnerability in application, system, device, etc. Each security problem gets a unique CVE identifier and is listed as well in the NVD registry. Additionaly, sometimes further efforts can be linked to the underlying issues in application code itself, and will associate the CVE with particular CWE IDs. See https://cve.mitre.org

CWE

CWE stands for "Common weakness enumeration" and is a way to define a particular security issue in programming code. CWE is a security effort lead by the US government and industry to define a taxonomy for coding problems that lead to security vulnerabilities. Each vulnerability reported has an CVE ID and should be linked to the underlying CWEs that lead to the issue. There are currently approximately 800 items defined in CWE and efforts are underway to map their technical impacts to what kinds of problems the weakness may cause, as well as ISO 27010. CWE is often known for it's CWE Top 25 and On the Cusp lists of the most common software security problems. See https://cwe.mitre.org

vulnerability

This is a tricky word, especially in application security or cybersecurity. The simple definition in a software context is that the code has some problem that could be exploited by someone at some point. Some think of it as a piece of code with a proven exploit, IE a static analysis violation with a stack trace and values used. This is a very narrow definition that probably doesn't help improve the state of the art. I prefer the idea that it's code that is exploitable based on the body of knowledge (as encapsulated in software coding standards).

CAN (Controller Area Network)

Controller Area Network aka CAN aka CAN Bus is a wiring standard for vehicles that enables communication between various components and devices without having a host computer. For example doors, brakes, transmission.

MISRA

MISRA or Motor Industry Software Reliability Association is a set of programming guidelines for C and C++ software development. The goal of the guidelines is to help reduce risky code upfront by avoiding language constructs that are more prone to bugs. This will increase automotive reliability, safety and quality.

IoT (Internet of Things)

common devices that have been internet enabled in order to remotely monitor and manage them, or collaborate with other devices, or provide extra functionality by accessing the internet. Like an internet enabled thermostat that you can control with your smartphone - see the Nest from Google.

Phishing

A security attacked based on tricking you to put important data like your login and password into a fake website. For example, a faked email from your bank, even using the proper bank picture you're expecting. They tell you there has been a breach and you need to login immediately and change your password. Don't do it, go to the website directly and see if they have any message there. When in doubt, call the company.

Monthly Archives: October 2026

Jumping the Goldfish: IoT insecurity Eight Years Later.