Date: Thu, 9 Nov 2023 12:44:34 -0500 From: "Mike O'Connor" <mjo@...o.mi.org> To: oss-security@...ts.openwall.com Cc: !CVE Team <contact@...cve.org> Subject: Re: !CVE: A new platform to track security issues not acknowledged by vendors !CVE Team, >From an open source perspective, the CNA(s) who might be assigning CVEs might not be a "vendor". As just one example, the GitHub CNA assigns tons of CVEs for open source software using GitHub's Security Advisories, but I wouldn't think of GitHub as a "vendor" for all the projects they host. How do you deal with CNAs who might be fine with assigning a CVE, but tagging it as DISPUTED? Perhaps they don't want to build deprecated decades-old code to scope out the severity of a buffer overflow some random fuzzbot found. How would !CVE work for the Linux kernel, where most security fixes have git commit hashes but not CVEs? You don't seem resourced for that. Overall, it seems like the prbolem you're trying to solve is "I'm not getting my unique tag from CVEs CNAs for my vulnerability". Your fix is "some other unique tag mechanism for vulnerabilities". I think I see where this might be going: https://xkcd.com/927/ Have you considered, I dunno, working with the CVE folks, addressing what CNA rules you think may be broken? Not all vulnerabilties are created equal, and it may make sense to create more alternate systems to deal with that. But, forking off on your own should be done with some due diligence. The last thing the security community needsi are even more fractured efforts, as they deal with enough fractured stuff. My $0.02, FWIW... -Mike -- Michael J. O'Connor mjo@...o.mi.org =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--= "But we decide which is right... and which is an illusion." -Moody Blues
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.