Re: Sources: Full and Partial Coverage

[security curmudgeon <jericho@attrition.org>]

On Fri, 18 May 2012, Damir Rajnovic wrote:

: Hear, hear! Defining the goal in the scope of products is much better 
: than sources and I am saying this as a consumer of CVEs. I have a piece 
: of SW and I would like to know what is going with it. If the currently 
: used sources do not cover the product 100% then the workaround can be to 
: publicly say "we cover product X to an estimate 80% (or whatever)". That 
: way CVE consumers are told of the situation.

Does your answer change if the percentage cannot be answered with any 
certainty at all?