Date: Thu, 27 Apr 2017 17:31:01 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: MITRE is adding data intake to its CVE ID process On Thu, Apr 27, 2017 at 08:37:51AM -0600, Kurt Seifried wrote: > longer term the DWF will be taking this on, but like most things in tech > there have been unexpected delays and issues. I'll keep the list appraised > as things improve (we should start seeing progress in the next month or > two). Meanwhile, why don't you simply proceed to assign CVEs per requests made in here like you do on (linux-)distros? I think this would help. As you're aware, personally I'm not into CVEs, but I liked the side-effect that people's desire to have CVEs brought more vulnerability information in here. I am a bit concerned that MITRE's change may result in us getting notified in fewer cases, especially if we continue to redirect to MITRE those CVE requests that still arrive in here. This is going to result in not only fewer CVE requests sent in here, but also in fewer vulnerabilities being disclosed in here - or at least in them being brought in here with an extra delay (after MITRE has assigned a CVE ID and reminded the person that they should notify oss-security, which thankfully they do). Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.