Date: Wed, 8 Nov 2023 15:07:40 +0100 From: Solar Designer <solar@...nwall.com> To: !CVE Team <contact@...cve.org> Cc: oss-security@...ts.openwall.com, fulldisclosure@...lists.org Subject: Re: !CVE: A new platform to track security issues not acknowledged by vendors On Wed, Nov 08, 2023 at 02:22:27PM +0100, !CVE Team wrote: > - An identifier following common naming starting with an exclamation > mark(!) Example: !CVE-2023-0001 Please make these more distinctive, so that searching (e.g. the web or mailing list archives) for CVE-2023-0001 wouldn't find both the actual CVE and the !CVE, which are likely totally unrelated to each other. In fact, searching specifically for the !CVE could be difficult as the exclamation mark may be dropped by the tokenizer when indexing content. One way to do that while maintaining the pun would be to use a different numbers syntax, radix, or range, e.g. prefix all numbers with more 0's than CVEs normally use (resulting in something like !CVE-2023-00000001), prefix them with a radix specifier (e.g. !CVE-2023-0x0001), or start the numbers at 10 million (there were some in the 1+ million range in prior years, so this feels risky). I tried launching something similar in 2016, but without the pun on CVE, and taking the lack of requirements to the extreme: https://www.openwall.com/ove/ It saw a bit of use, but didn't really take off. Maybe yours will. Good luck! Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.