Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 8 Nov 2023 15:07:40 +0100
From: Solar Designer <>
To: !CVE Team <>
Subject: Re: !CVE: A new platform to track security issues not acknowledged by vendors

On Wed, Nov 08, 2023 at 02:22:27PM +0100, !CVE Team wrote:
> - An identifier following common naming starting with an exclamation
>   mark(!) Example: !CVE-2023-0001

Please make these more distinctive, so that searching (e.g. the web or
mailing list archives) for CVE-2023-0001 wouldn't find both the actual
CVE and the !CVE, which are likely totally unrelated to each other.  In
fact, searching specifically for the !CVE could be difficult as the
exclamation mark may be dropped by the tokenizer when indexing content.

One way to do that while maintaining the pun would be to use a different
numbers syntax, radix, or range, e.g. prefix all numbers with more 0's
than CVEs normally use (resulting in something like !CVE-2023-00000001),
prefix them with a radix specifier (e.g. !CVE-2023-0x0001), or start the
numbers at 10 million (there were some in the 1+ million range in prior
years, so this feels risky).

I tried launching something similar in 2016, but without the pun on CVE,
and taking the lack of requirements to the extreme:

It saw a bit of use, but didn't really take off.  Maybe yours will.

Good luck!


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.