Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Feb 2017 23:39:41 +0000
From: "Williams, Ken" <>
To: "" <>
Subject: RE: MITRE is adding data intake to its CVE ID process


Your perception is incorrect.  I can assure you there is no 
CVE-related bias whatsoever towards commercial software, or against 
OSS.  Never has been any CVE-related bias against OSS, and I can't 
imagine there ever will be.

I'm a big OSS fan and advocate, and although I will only speak for 
myself, I'd be willing to bet that everybody else involved with the 
CVE project is too.

As far as sending copies of CVE web form submissions to oss-sec, or 
posting anywhere else, keep in mind that much of that info needs to 
be embargoed until a vendor security advisory is published.

Ken Williams

Disclaimer: I've been on the CVE Board for 17 years.

> -----Original Message-----
> From: Tim []
> Sent: Friday, February 10, 2017 4:49 PM
> To:
> Subject: Re: [oss-security] MITRE is adding data intake to its CVE ID
> process
> > This is a fine supplement to the oss-security list, but it completely
> > removes the possibility of natural discussion of CVEs by members
> > of the list.  Valuable insights might never surface unless every list
> > member manually monitors the database and decides to send a
> > message regarding a given database entry.
> >
> > In short, it removes the best avenue toward the collaboration upon
> > which all OSS development is based in the first place.  I don't mind
> > if MITRE requires submitters to use their web stuff, but messages
> > generated by that tool should also appear on this list, or something
> > very valuable will be lost.
> It's pretty clear that MITRE's interest is increasingly aligned with
> commercial software vendors and not the open source community at
> large.  I wouldn't hold your breath on improvements to how The MITRE
> Corporation deals with our community.  If you want something better,
> we'll have to build it ourselves.  Note that I'm just the messenger.
> tim

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.