Date: Fri, 10 Feb 2017 16:10:24 -0800 From: Tim <tim-security@...tinelchicken.org> To: oss-security@...ts.openwall.com Subject: Re: MITRE is adding data intake to its CVE ID process > Your perception is incorrect. Actions speak louder than words. Data points: - The fact that so many lesser known researchers couldn't get an ID for so long when they asked for one. - As already discussed, the web form's "Please ensure vendor or product exists in the Products and Sources list". For an open source project, they give up and outsource the process, which then can't be used for obtaining an ID before release. - The most telling though is the entire CNA program, particularly when it allowed only commercial vendors. If a vendor decides something isn't a problem, they can block or slow CVE assignment. It's a corruption of service that ought to be for the public benefit. (And yes, this does happen.) Reporting vulnerabilities in a "responsible" manner is already a huge pain in the ass. Every year getting a CVE is harder and harder, particularly prior to publication (which is how it should be assigned, since the whole point of the CVE is to minimize confusion about which vulnerability we're talking about). tim
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ