Thread by @LilyAblon

Here are a few insights on the #Meltdown and #Spectre vulnerabilities based on my recent @RANDCorporation research. /1 rand.org/pubs/research_…

First, this is yet another reminder that vulnerabilities can last a long time (our data showed vulnerabilities lasted 6.9 years before being publicly disclosed) and have a low chance of being discovered (5.7% per year). /2

But the #Meltdown / #Spectre news also has me thinking about a "swarm mentality" among hackers of all stripes after a vulnerability is disclosed. /3

This is based on the idea that, where one vulnerability exists, so do others. Thus, bug hunters and exploit developers alike "swarm" the code base after a high-profile disclosure. /4

I've heard a lot of colorful analogies for this: Vulnerability researchers are sharks who smell blood in the water. Or we're all kids at a youth soccer game, following whoever has the ball. /5

The takeaway is that a lot of groups are likely now combing through the code base where #Meltdown and #Spectre were found. So it's possible that other vulnerabilities will emerge, too. /6

(This can be good or bad news - largely depending on how easy it is to exploit new vulnerabilities found, and how quickly a patch can be applied.) /7

In my @RANDCorporation report, I call these "close collisions," where the discovery of one bug was a direct result a nearby bug's discovery. /fin rand.org/pubs/research_…