Date: Fri, 10 Feb 2017 22:44:48 -0500 From: Adam Caudill <adam@...mcaudill.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: MITRE is adding data intake to its CVE ID process On Fri, Feb 10, 2017 at 7:10 PM, Tim <tim-security@...tinelchicken.org> wrote: > - The fact that so many lesser known researchers couldn't get an ID > for so long when they asked for one. > > - As already discussed, the web form's "Please ensure vendor or > product exists in the Products and Sources list". For an open > source project, they give up and outsource the process, which then > can't be used for obtaining an ID before release. Once it's completely up and running, DWF should address these issues. Researchers and organizations can easily become CNAs under DWF, with assigned CVE blocks. For OSS, the process of getting a CVE (including pre-publication) should be much simpler than it has been, especially in recent years. It's not quite there yet, but Kurt and team have put a lot of effort into laying the groundwork for a much better solution than the ad-hoc "send an email and hope" process that we've become accustomed to. The old system was far from perfect, as is the interim MITRE web form - hopefully with the help of the community, DWF will be able to provide a better process for all involved. For OSS, DWF is the solution we need to be focused on, and helping it to evolve to suit the needs of everyone. > - The most telling though is the entire CNA program, particularly when > it allowed only commercial vendors. If a vendor decides something > isn't a problem, they can block or slow CVE assignment. It's a > corruption of service that ought to be for the public benefit. (And > yes, this does happen.) While I believe that DWF represents a substantial step forward for OSS, and getting CVEs to those that need them, when they need them; my feelings on CVEs for commercial software remain rather negative. I've stopped requesting CVEs for commercial software due to all of the issues - if I discover something where I believe a CVE is especially important, I direct the request through CERT/CC or another origination. But, this is getting off-topic.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ