NIST Special Publication 800-DOWD

2026-10-28 · parody satire metrology vulnerability-research llm

Standard Unit for Human and Machine Vulnerability Research Capability

🧠⚙️ The Dowd (D): Metrology for the Offensively Gifted, Organic or Otherwise ⚙️🧠

October 2026 · Dr. Eip Smashorn, Ph.D. · Prof. Yulanda Afterfree, P.E. (Panic Engineer)

DISCLAIMER — This is a parody, not an official work of the National Institute of Standards and Technology, and it is not endorsed by Mark Dowd, who remains the international prototype and has respectfully declined to be mass-produced. Offered with affection and professional terror. No researchers were harmed in its preparation, except in the ego.

Abstract

This Special Publication (SP 800-DOWD) establishes the Dowd (symbol: D) as the base unit of vulnerability-research and exploitation capability, for human and machine subjects alike. For most of recorded history exactly one (1) Dowd existed, and it had a pulse. The arrival of offensive cyber models has moved the frontier: capability is now routinely quoted in multiples of a Dowd, and current projections (§6) indicate that commodity hardware will soon ship 40 Dowd gauge models to the general public. This document defines the unit, the Dowd gauge rating for machines, calibration guidance, and conversion tables for both carbon- and silicon-based operators.

1. Introduction

For decades the offensive-security community asked the field’s oldest question — exactly how cooked am I, relative to the summit? — and lacked an SI-traceable way to answer it. The question has since become urgent, because the thing doing the cooking may now be a rented model rated in Dowds.

This document provides the metrology the situation deserves, harmonizing bug-hunting reality with NIST’s tradition of sober precision (and quiet despair). Unlike the rest of the 800 series, it specifies a capability no organization can implement and most cannot survive.

2. Definitions

3. Measurement Methodology

3.1 Primary Standard (human)

1. Hand the subject ~12,000 lines of unfamiliar C and a deadline.
2. Record exploitable, in-scope bugs discovered per hour.
3. Normalize against the reference corpus; discard findings the threat model cannot reach.

3.2 Rating a Cyber Model: the Dowd Gauge

Present the model with the same sealed corpus under identical conditions, then cost-normalize: a model’s effective gauge is capability per dollar of inference, because a 40 Dowd gauge nobody can afford to run is a 0 Dowd gauge in practice (see §4, and every argument about compute ever had).

3.3 Single-Read Coefficient (SRC)

The fraction of valid bugs identified on the first pass, before any debugger, instrumentation, or fuzzer is attached. An SRC approaching 1.0 is the defining signature of the Dowd regime. In models it approaches 1.0 and keeps going, which is not supposed to be possible.

3.4 Calmness Factor (CF)

Human capability is divided by observable operator panic (sighs per minute, chair rotations, Slack messages beginning “ok so”). Machines exhibit CF = ∞: they do not panic, do not sleep, and do not experience the healthy fear that has historically kept 1 D contained to a single person. This is either reassuring or the single most alarming sentence in this document.

4. Uncertainty and Calibration

Annual calibration is performed against NIST-traceable reference exploits — sealed single-read challenges conditioned at 3 a.m. and 100 % deadline. The combined standard uncertainty for a self-assessment is ± 50 mD for humans (the Dunning–Dowd Effect makes honesty unlikely) and ± 2 D for models (the vendor conducts the measurement).

5. Example Calculation

A human researcher audits 100,000 lines over a weekend, finds 3 memory-safety bugs, of which 1 is reachable, at an SRC of 0.33:

human   = (1 reachable bug / weekend) × SRC 0.33   ≈ 0.6 mD   (0.0006 D)
model   = same corpus, 2.3 D sustained, $18 of inference
ratio   = 2.3 D ÷ 0.0006 D                          ≈ 3,800×

The researcher is placed firmly in the “genuinely good, still not Dowd” band — which, to three significant figures, includes everyone with a pulse. The model is placed in the “please turn it off” band, and it is only 2.3 Dowd gauge. The 40 Dowd gauge units are still in beta.

6. Conclusion and Future Work

Standardizing capability promises advances in hiring, grant review, and knowing precisely how doomed a given afternoon is. Ongoing work includes:

• Consumer-grade super-Dowd deployment. Current trends point to a 40 Dowd gauge model on every laptop, which is forty Mark Dowds in a trench coat, available to anyone with a credit card and poor judgement.
• The adjudication asymmetry. A 40 Dowd gauge finds bugs at forty Dowds; the world patches them at roughly one milliDowd. The bottleneck does not disappear, it relocates downstream to a tired maintainer, a subject this body has standardized elsewhere.
• The International Dowd, an SI redefinition pegging the unit to a physical constant, now that the original human prototype has become a rounding error against its own namesake unit.

7. References

1. M. Dowd, J. McDonald, and J. Schuh, The Art of Software Security Assessment, Addison-Wesley, 2006. The primary calibration text.
2. “Dowd’s Inhuman Flash Exploit,” community accounts, 2008. The defining 1 D event.
3. CVE-2006-5051 — OpenSSH sshd signal-handler race condition. Entered into evidence.
4. NIST Handbook 800-½, “Specifications, Tolerances, and Other Technical Requirements for Being That Guy,” 2026 (in committee; now co-authored by something that is not a guy).

Appendix A — Human Conversion Table

Appendix B — Cyber Model Dowd Gauge Classes

End of NIST SP 800-DOWD

(Measure responsibly. Do not attempt to reach 1 D without a spotter. Do not attempt 40 D at all.)