Nine Hours on a Train to VulnOptiCON
Three days of VulnOptiCON, two venues, one country smaller than Rhode Island, and the five things I would hand to anyone who patches for a living.
Last month I went to Luxembourg to talk about CVE Board meeting minutes. Getting there meant flying into Paris and catching a high-speed train, which then sat still in the middle of the French countryside for five hours. I was on that train for nine hours in total. High speed, it turns out, describes the hardware. The good news is that Empirical now holds a €93 SNCF voucher, good for any trip in the next year, so if anyone at the company needs to go somewhere in France, slowly, in the next twelve months, see me.
All of that to stand in front of a room of very smart Europeans and argue that minutes should record who voted.
VulnOptiCON is the FIRST technical colloquium on vulnerability forecasting, run with CIRCL, Luxembourg's national CSIRT. Day one was in Belval, a university campus built on top of an old steelworks, so we spent a day talking about legacy infrastructure while sitting next to some. Days two and three were at the Marriott. My Empirical colleagues Jay Jacobs and Ben Edwards made the trip as well (I have not asked how long their trains sat in a field, out of professional courtesy), and both gave smart talks. Jay's Broken, Reachable, and Harmful asked us to rethink what we actually mean by a vulnerability. Ben's CVE2VEC takes sparse vulnerability data and makes it dense enough to fill in missing values and see where exploitation is heading.
The program also had a slot called the Mass Debating Session. I will let you sound that one out on your own.
The Talks I'm Still Thinking About
| Session | What stuck |
|---|---|
| GCVE (CIRCL, four or five talks plus a pre-con workshop) | A working alternative identifier scheme, with a crowdsourced CPE project at cpe.gcve.eu |
| Erick Galinkin, NVIDIA | Two years of finding bugs with LLM agents. I came home pricing a DGX Spark against renting H100s, which is how these talks always end |
| Regina Joseph, forecasting keynote | Forecasting accuracy is measurable and repeatable, which means it can be scored |
| Tina Rezaei, University of Twente | Characterizing IoT CVEs from descriptions alone. I have been poking at a bigger version of this since I got home |
| My talk | Not recorded, but the slides are on rogolabs.net, and the answer to "did you really read all 116 meetings" is still yes |
Five Things Worth Bringing Home
If you patch things: the fixed version is still missing from most of the data. In my own pull for the talk, 80.8% of CVE records published since 2023 name no fixed version, because the CNA rules make it a SHOULD. Your scanner is not lying to you. It just was never told.
If you build tooling: plan for more than one identifier. GCVE is real, it is shipping, and CIRCL is not waiting for anyone's permission. If GCVE and CVE do not interoperate, we fragment, and you are the one writing the join.
If you ship software into the EU: the CRA's reporting obligations started on September 11. For a room full of vulnerability people, it got remarkably little airtime. Do not take the quiet as a sign it is handled.
If you forecast anything: keep score. The keynote's whole point was that good forecasters are made by measuring them. Most of us publish predictions and never check them.
If you go next year: a lot of the program was tooling built on top of the data. Not much of it was about fixing the data. That is the talk I want to see in 2027, and I suspect I will end up giving it.
So that is VulnOptiCON: I went to Luxembourg to talk about governance and came home with a train voucher and a sudden need for a GPU. See you next year. I'll be the one on the slow train.
One last thing. I spent longer than I would like to admit standing in a pastry shop with tenth grade French and serious jet lag, doing the math in my head and trying to work out why these prices felt wrong. They are wrong. The 9-box works out to €2.22 a macaron, the 16-box to €2.44 and the 25-box to €2.40, so the bigger boxes cost you more per macaron. I cannot even buy dessert without doing data science.
