Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

Post reply on HN
Print view View original

241–250 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#241

Post by LPisGood »

dboreham wrote: post #81
xphos wrote: post #70

Earlier quoted context omitted.

Listen, I hate the debt, but we have an income problem, not a spending problem. The military looks like a waste, but it does more than build bombs i.e research etc. The issue we have is that republican every chance they get since the 1970s have cut taxes. And then blamed democrats for causing the deficits. We don't need smaller governments. We need a reasonable tax system that taxes people. It can be progressive like…

Military also employs a bunch of people who otherwise would be poor. Also provides a gentrification path for a bunch of previously poor people extending throughout their lives.

Yes, a big part of the size is because the military is a massive and horrendously inefficient jobs, education, housing, and healthcare program.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#242

Post by lars_francke »

wichitawch wrote: post #161

I'm surprised that it was USA's responsibility to fund this in the first place. Why weren't other countries providing funds?

The CVE program was started over 25 years ago. It is very reputable (until yesterday) and it was very much in the interest of the US to be seen as the stewards of this.

The funding requirements can't be that high and I'm willing to bet that other countries and entities would have happily stepped up if they had the chance.

Up until recently CVE was very centralized and only in the last few years have there been steps in more decentralization with CNAs taking more responsibility, Red Hat as a CNA of last-resort etc. So, the cost of doing all of this work has already been shifted partially (!) away from the US but I have not seen any movement towards e.g. moving the program to a foundation which could have been done.

Personally I would conclude that it was the responsibility of the US to pay for this because they wanted to and it was in their best interest to control this program.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#243

Post by bruce511 »

Aurornis wrote: post #99
ggm wrote: post #51

I wish this hadn't happened. I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do t…

This sort of thing is happening across the federal government. There is no rhyme or reason. DOGE has been given an unrealistic target for cuts and they're desperately cutting whatever they can get their hands on. If you look at the federal budget it's nearly impossible for DOGE to hit their stated goals without touching benefits like medicare and social security (which are off limits so far) so the only option is dee…

>>They thought they voted for something different

Like what exactly? I mean the guy ran on cutting the budget by 2 trillion. In his last term he gave tax breaks yo the rich. Where did they think the cuts were coming from?

He ran very hard on raising tarrifs. Which demonstrably raise prices (thats literally their goal.) But now people claim "I didn't vote for this."

In truth they voted for him because he was the Republican on offer and they're die-hard Republican. The Republican party has made no secret of its agenda for decades.

I get it, people are good at cognitive dissonance. But this is the place for blunt truth. They voted for this. I'm not letting Republicans got off the hook here. They voted for this.

Just like to my Republican friends who are upset that CVE is cut. You voted for this. The general public benefit from CVE even though they dont know it exists. Just like you benefitted from dozens of other programs you didn't know existed, but have also been cut.

That's the problem with cuts. They ultimately end up hurting everyone.

Now clearly there's some fat that could be trimmed. Companies do it all the time. Done well its good. Swinging a hatchet in a crowded elevator does not seem like "Done well".

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#244

Post by markhahn »

riffraff wrote: post #207
tw04 wrote: post #198

Earlier quoted context omitted.

I think you mean wonder kids.

wunderkind is a loanword, it's one of those cases of a German word being used but being odd in English since it's so similar. Like kindergarten which is often speller as "garden". https://en.m.wikipedia.org/wiki/Wunderkind_(disambiguation)

"tariff as wunderwaffe" often comes to mind these days.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#245

Post by hiddencost »

wichitawch wrote: post #185
defrost wrote: post #176

Earlier quoted context omitted.

It's a near certitude that Russia and China each have databases of exploitable software errors and prize zero days. It was to the advantage of the US and allies to coordinate and lead in tracking and fixing such errors. Multiple countries, companies, and individuals contributed finding and fixing bugs. The administrative task of keeping track was one part of a greater picture, a part that came with first to be advise…

> It was to the advantage of the US and allies to coordinate and lead in tracking and fixing such errors. From what I understand of the article, none of these allies were funding it. > Multiple countries, companies, and individuals contributed finding and fixing bugs. Clearly that itself isn't enough. Someone has to pay for maintaining this service. It appears that no one other than USA spent money in funding it.

[flagged]

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#246

Post by mjevans »

mjevans wrote: post #25

Mr. President, Do you want China to get the reports instead, or do you want the NSA to have a lead time where the vuln's are useful tools?

It seems phrasing it in the form of a joke was too much.

I was trying to convey (with levity/humor) WHY it should continue to be funded as well as the argument that should be made to the one currently in control of the spineless US Congress.

Yes, fixing the vulnerabilities is important. However what the government probably does gain from it is an inside advantage in the lead time for vulnerabilities to protect against, as well as to exploit on adversaries.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#247

Post by throitallaway »

Gigachad wrote: post #224
arghandugh wrote: post #136

This industry relentlessly lionized Trump and Musk, elevating them to positions of power and handing them the power to destroy at will. This is your moment! Enjoy it!

It’s astounding that the users here watched all the horrendous things going on and ignored them. But now the CVE numbers are gone it’s shocking and too far.

Come again? This is Hacker News, a heavily moderated forum with a narrow focus. We don't discuss Israel or El Salvador here (unless it's tech related.)

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#248

Post by decide1000 »

jauco wrote: post #235
weinzierl wrote: post #228

Earlier quoted context omitted.

Try to talk to the people from the Sovereign Tech Fund, they have a history of sponsoring security relevant projects in the EU.

And maybe the sidn fund?

Nlnet for opensource

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#249

Post by ngneer »

czk wrote: post #52
hansvm wrote: post #48

Weren't there major problems with the current CVE implementation, especially with the waves of script kiddies and AI tools spamming the database and the fact that projects who take security seriously have little to no say in the "score" that gets assigned?

and then a random 9.8 critical comes that affects some software you have in a way that makes it a 0 in your environment but it doesn't matter cause the cve tanks your organizational Security Score (tm) by 10 arbitrary points and management is wondering when you'll secure the company again because the Security Score is their only tangible deliverable to measure success

Spot on. Vulnerability scanners that make up an organizational Security Score (TM) tend to operate at the wrong level of abstraction, flagging some library somewhere that never runs and has nothing to do with your production flow or architecture, or some test keys with zero security impact. Go explain that to management, because obviously the security tools are right and you are wrong. This sad state of affairs is unfortunately the best that the security industry has been able to deliver. Trying to wrangle complexity by adding more complexity is the craziest notion to me. Yes, no scoring scheme is perfect, but when the scheme introduces more noise, what have we gained (well, security vendors gain, but what have organizations gained).

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#250

Post by throitallaway »

LPisGood wrote: post #241
dboreham wrote: post #81

Earlier quoted context omitted.

Military also employs a bunch of people who otherwise would be poor. Also provides a gentrification path for a bunch of previously poor people extending throughout their lives.

Yes, a big part of the size is because the military is a massive and horrendously inefficient jobs, education, housing, and healthcare program.

Don't forget all the beak-wetting that happens along the way when signing contracts etc. That's where an actual difference could be made.
Post reply on HN