[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 8 Nov 2023 15:07:40 +0100
From: Solar Designer <solar@...nwall.com>
To: !CVE Team <contact@...cve.org>
Cc: oss-security@...ts.openwall.com, fulldisclosure@...lists.org
Subject: Re: !CVE: A new platform to track security issues not acknowledged by vendors
On Wed, Nov 08, 2023 at 02:22:27PM +0100, !CVE Team wrote:
> - An identifier following common naming starting with an exclamation
> mark(!) Example: !CVE-2023-0001
Please make these more distinctive, so that searching (e.g. the web or
mailing list archives) for CVE-2023-0001 wouldn't find both the actual
CVE and the !CVE, which are likely totally unrelated to each other. In
fact, searching specifically for the !CVE could be difficult as the
exclamation mark may be dropped by the tokenizer when indexing content.
One way to do that while maintaining the pun would be to use a different
numbers syntax, radix, or range, e.g. prefix all numbers with more 0's
than CVEs normally use (resulting in something like !CVE-2023-00000001),
prefix them with a radix specifier (e.g. !CVE-2023-0x0001), or start the
numbers at 10 million (there were some in the 1+ million range in prior
years, so this feels risky).
I tried launching something similar in 2016, but without the pun on CVE,
and taking the lack of requirements to the extreme:
https://www.openwall.com/ove/
It saw a bit of use, but didn't really take off. Maybe yours will.
Good luck!
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
