[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID:
<SY8P300MB071119F7900AB82CED4E64FEEEC3A@SY8P300MB0711.AUSP300.PROD.OUTLOOK.COM>
Date: Fri, 7 Nov 2025 09:01:10 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Becoming a CVE Naming Authority for your project
Olle E. Johansson <oej@...ina.net> writes:
>I think there are very few one person projects that have knowledge, time and
>resources to operate a CNA.
This isn't one person trying to run a CNA for something like Apache, it's one
person running a CNA for Bob's Text Editor, which gets seven proposed CVEs a
year of which six are AI slop and the seventh is an airtight-hatchway
"vulnerability". It's a means of dealing with AI slop and bogus CVEs for
small projects as per a much earlier portion of the discussion.
Just for reference the response I got at the time, triggered by some random
CNA issuing a bogus CVE that I didn't find out about until weeks later, was:
Unfortunately, Individuals are not eligible to become a CNA.
If your project is hosted on GitHub, consider using the GitHub CNA.
So that would in theory be one way to do it, but since its main purpose is
dealing with a flood of AI slop I'm not sure that moving to having the GitHub
CNA flooded with it is the right way to do it. The goalposts have shifted a
lot since the CNA model was originally set up, for many projects the main
issue is dealing with AI slop, not dealing with vulns.
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
