Date: Sun, 12 Feb 2017 00:35:41 +0100 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: MITRE is adding data intake to its CVE ID process All - thank you for sharing your concerns in this thread. FWIW, MITRE had notified me of this coming change a few days before the oss-security posting, and I e-mailed them privately with some of the same concerns and thoughts. MITRE - thank you for responding to the concerns, and for all your effort over the years. On Fri, Feb 10, 2017 at 10:59:27PM -0500, cve-assign@...re.org wrote: > C5. I want MITRE to send the https://cveform.mitre.org form data, and > the CVE ID, to the oss-security list at the same time that these are > sent to the requester. > > R5. We have had internal discussions within MITRE about this. We are > able to implement this easily if the community requires this approach. > At the moment, we are expecting the requester to resend this > information to oss-security once they accept their CVE ID assignment. This sounds great. Since a mailing list isn't great for polls (would be too many messages), I ran this Twitter poll instead (not the exact same community indeed, but I hope it's similar): https://twitter.com/solardiz/status/830164779893395456 "When MITRE assigns a CVE ID to a public issue or once the issue is public, should they automatically post to a mailing list?" 5% No 63% Yes, to existing list(s) 29% Yes, to new list(s) 3% Other 98 votes in 24 hours There were no replies (besides the votes themselves), and no retweets. So 92% of those who voted want such postings to go to some mailing list(s). 63% want them to go to existing mailing list(s). I suggest that those existing lists be oss-security for Open Source software and full-disclosure for other software (or for both?), although we'd need to hear from the moderators of full-disclosure regarding the latter. For now, let's just say that we seem to want to have CVE ID assignments in Open Source software to be automatically posted to oss-security. MITRE - can you please implement that, and we'll see how it goes and whether we need it adjusted or possibly discontinued if things go wrong or if there's opposition (so far, there's almost none)? > Please see http://www.openwall.com/lists/oss-security/2017/02/09/26 > for an example. This is also an example of how the change breaks threading. First, there was a thread about the issue on the list. Then there was CVE request and assignment off-list. And then there's this new thread on the CVE assignment. To MITRE's credit, in this very example above they did suggest to "reply to your own oss-security post", which would then keep the thread. Perhaps this should be emphasized more, and the rationale explained? > C6. I want MITRE to send the https://cveform.mitre.org form data to > the oss-security list as soon as that data is entered (i.e., before a > CVE ID exists). > > R6. We have had internal discussions within MITRE about this. We are > not yet able to implement this easily. We may work on this if the > community requires this approach. However, our understanding of CVE > consumers is that they look to MITRE as a source of vulnerability > information after a CVE ID number exists, not before. Many people interested in timely access to vulnerability detail, and who could contribute to discussions, are primarily not "CVE consumers". For example, I am more interested in being notified of a potentially relevant vulnerability than about it having a CVE ID number. Anyway, let's try with the CVE assignments postings first and see how it goes, especially given that it's easier for MITRE to implement. It's easier for the oss-security moderators too, as MITRE will have already filtered out the spammy or otherwise unreasonable CVE requests (if any). A related concern, though, is that this pre-CVE-assignment vulnerability information is potentially valuable to attackers. I also ran this other Twitter poll a week earlier: https://twitter.com/solardiz/status/828000469037547524 "Are you concerned about potential leaks from or misuse by MITRE of non-public CVE request detail?" 14% Who's MITRE, what's CVE? 55% Yes: valid risk & concern 23% No: can't happen or is OK 8% Other 394 votes in 24 hours Many replies, including several people sharing anecdotal evidence of MITRE's integrity (and none to the contrary). 14 retweets. Thus, looks like a hotter topic than whether to post to mailing lists, yet the results may be biased by me bringing this question up (someone might not have been concerned before they read the question). Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.