[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Feb 2017 22:44:48 -0500
From: Adam Caudill <adam@...mcaudill.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: MITRE is adding data intake to its CVE ID process
On Fri, Feb 10, 2017 at 7:10 PM, Tim <tim-security@...tinelchicken.org> wrote:
> - The fact that so many lesser known researchers couldn't get an ID
> for so long when they asked for one.
>
> - As already discussed, the web form's "Please ensure vendor or
> product exists in the Products and Sources list". For an open
> source project, they give up and outsource the process, which then
> can't be used for obtaining an ID before release.
Once it's completely up and running, DWF should address these issues.
Researchers and organizations can easily become CNAs under DWF, with
assigned CVE blocks. For OSS, the process of getting a CVE (including
pre-publication) should be much simpler than it has been, especially
in recent years. It's not quite there yet, but Kurt and team have put
a lot of effort into laying the groundwork for a much better solution
than the ad-hoc "send an email and hope" process that we've become
accustomed to.
The old system was far from perfect, as is the interim MITRE web form
- hopefully with the help of the community, DWF will be able to
provide a better process for all involved. For OSS, DWF is the
solution we need to be focused on, and helping it to evolve to suit
the needs of everyone.
> - The most telling though is the entire CNA program, particularly when
> it allowed only commercial vendors. If a vendor decides something
> isn't a problem, they can block or slow CVE assignment. It's a
> corruption of service that ought to be for the public benefit. (And
> yes, this does happen.)
While I believe that DWF represents a substantial step forward for
OSS, and getting CVEs to those that need them, when they need them; my
feelings on CVEs for commercial software remain rather negative. I've
stopped requesting CVEs for commercial software due to all of the
issues - if I discover something where I believe a CVE is especially
important, I direct the request through CERT/CC or another
origination. But, this is getting off-topic.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
