[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Feb 2017 16:10:24 -0800
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Subject: Re: MITRE is adding data intake to its CVE ID process
> Your perception is incorrect.
Actions speak louder than words. Data points:
- The fact that so many lesser known researchers couldn't get an ID
for so long when they asked for one.
- As already discussed, the web form's "Please ensure vendor or
product exists in the Products and Sources list". For an open
source project, they give up and outsource the process, which then
can't be used for obtaining an ID before release.
- The most telling though is the entire CNA program, particularly when
it allowed only commercial vendors. If a vendor decides something
isn't a problem, they can block or slow CVE assignment. It's a
corruption of service that ought to be for the public benefit. (And
yes, this does happen.)
Reporting vulnerabilities in a "responsible" manner is already a huge
pain in the ass. Every year getting a CVE is harder and harder,
particularly prior to publication (which is how it should be
assigned, since the whole point of the CVE is to minimize confusion
about which vulnerability we're talking about).
tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
