Gather feedback on reported vulnerabilities

[adamjanovsky]

It would be great if we could design vulnerability notifications in a way that encourages the recipient to evalute the risks and label our finding either as true positive or false positive. This would allow us to polish the classifiers, it also collects precious labeled instances.

@J08nY, could we somehow incorporate it into the notification system?

[J08nY]

Ugh, okay this is doable although it may be a lot of work. I am just now slowly getting the notifications to work, it is not easy to render the certificate changes and get the information about the changes from the diffs. But I guess to get a good user experience we have to have that and adding this feedback on top is not that hard.

[adamjanovsky]

Just a quick thought here. Maybe we could just add some line into the notification mail: dismiss as false positive or something like that... That could actually visit a link that would report us.

[J08nY]

For sure, but as notifications are not even enabled on the site right now and wont be for the foreseeable future (we have to figure out a way to send email from the university network which is wicked limited) I view this as a low priority thing.