Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Feb 2017 16:10:24 -0800
From: Tim <>
Subject: Re: MITRE is adding data intake to its CVE ID process

> Your perception is incorrect.  

Actions speak louder than words.  Data points:

- The fact that so many lesser known researchers couldn't get an ID
  for so long when they asked for one.

- As already discussed, the web form's "Please ensure vendor or
  product exists in the Products and Sources list".  For an open
  source project, they give up and outsource the process, which then
  can't be used for obtaining an ID before release.
- The most telling though is the entire CNA program, particularly when
  it allowed only commercial vendors.  If a vendor decides something
  isn't a problem, they can block or slow CVE assignment.  It's a
  corruption of service that ought to be for the public benefit.  (And
  yes, this does happen.)

Reporting vulnerabilities in a "responsible" manner is already a huge
pain in the ass.  Every year getting a CVE is harder and harder,
particularly prior to publication (which is how it should be
assigned, since the whole point of the CVE is to minimize confusion
about which vulnerability we're talking about).


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.