7

Today a question mentioning CVE popped up. I would have assumed that what CVE stands for and what it actually is would be common knowledge on a Q&A-site focused on IT security (maybe I'm biased due to already being in the industry for some time now?).

However, one user added a comment explaining what CVE stands for and further linking to the corresponding Wikipedia article. This comment received 5 votes as of now - which is a solid vote count for comments on semi-active questions - indicating that at least 5 people benefited from the commentator going into detail on CVE, despite the cve tag already giving that kind of information.

So how should we approach such acronyms when posting or editing?

When introducing new acronyms in academic papers, the full phrase is usually written at least once and the acronym is put behind in parenthesis, e.g.:

"Lorem ipsum", said the Chief Information Security Officer (CISO).

And what level of knowledge should we assume for the Security SE community as a whole when using acronyms?

I don't think that "common/basic" acronyms like HTTP or TL;DR should be written in full, and expanded upon. But as mentioned above, CVE and similar "advanced" acronyms might need some more info or context added to the question/answer/comment.

1
  • Be glad this isn't biochemistry, or you'd be seeing acronyms like MALDI-FTICR-MS. Or military intelligence and combat support, where terms like C4ISTAREW abound... I think our "CVE" and "TLS" aren't that confusing.
    – forest
    Mar 21, 2019 at 22:59

2 Answers 2

Reset to default
5

The model I have been using is based on the fact that this is a site for Information Security professionals (yes, not only them, but that's the basis). If an acronym is within the standard Body of Knowledge of an Information Security professional, then we need not expand for the community.

Or if the acronym is used so ubiquitously that the acronym is understood without the underlying words, then it need not be expanded. I would argue that "CVE" is understood by itself without needing to understand what it stands for (I'm not sure that I could tell you what the "E" stands for from one day to the next).

That's not to say that if someone uneducated in security asked a question that we should not expand the acronyms. We should help were we can. But I would hope that someone in the security community would look up acronyms in relation to a discussion around a security topic they are interested in. I do not feel the need to expand an acronym for someone in that context. Especially if the acronym is explained in the tag.

I think the best general approach is to use tags to handle acronym explanations. That's what they are there for. In cases where there are more acronyms than the tag field can accommodate, I think the above model is useful.

1
  • I think this is the best way. If something is common, like DNS, it doesn't need explanation. If it's uncommon, then the acronym plus the full form should be used.
    – user163495
    Apr 17, 2019 at 14:12
2

Acronyms don't have to be spelled out in full, the explanation can be done subtly without degrading the reading experience for those who know them. This is true for even most common acronyms like CVE (or, if you prefer, ).

Therefore, I would argue that if you write a new question/answer and have to ask yourself "should I explain this acronym", then you should explain it. What you shouldn't do is mass-edit other people's posts linking CVE to Wikipedia.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .