CVE program faces swift end after DHS fails to renew contract [updated]

If what you want is a "don't piss off your coworkers by discussing topics unrelated to work that you know will annoy people" policy, that is fine, but don't pretend you are not engaging in politics.

Seemingly MITRE hasn't been advised yet whether the option to extend the contract from 2025-04-16 to 2026-04-16 will be executed. And there doesn't appear to be any other publicly listed approach to market for a replacement contract.

[1] https://www.fpds.gov/ezsearch/jsp/viewLinkController.jsp?age...

Indeed. Just as Germany knew their economy is vulnerable to Russian gas and did nothing about it, even after the 2014 invasion of Crimea. Just as the west knew moving their entire manufacturing sector to one country would make them vulnerable, but choose to ignore it because it was too profitable.

I never EVER saw politicians act proactively for the good of the nation or the people, all they do is act reactively after the shit hits the fan to control public opinion and blame someone else to make sure they get re-elected, that's it.

Once you realize our rulers aren't competent at their jobs or acting in the peoples' best interest, it all makes sense. They're in it for the grift and to enrich their monopolistic friends in the private sector, to make sure line goes up in the next quarter, that's it.

Yes, I know there are good politicians out there who care and fight for their local communities, but they never make it to rule at national or international stage and actually change the rotten system because the status quo doesn't allow that.

I think the question everyone in this thread should ask is: why is it the government's job to do this, especially given the prior widespread view that they're doing a bad job? Is the software industry so immiserated by poverty that it cannot organize its own distribution of security bulletins? Clearly not: GitHub already runs its own vuln tracking scheme that's better integrated with the tooling we use for open source software. The industry routinely sets up collaborations like standards bodies, information sharing groups and more. And there is as whole ecosystem of security companies to help you understand vulns in your stack.

So there seems nothing specific to CVEs that requires government involvement, but the existence of the tax funded scheme does discourage the creation of competitors that might function better.

But, to CVE or not to CVE ... that is not the question. US deficit spending is out of control. This sort of thing had to happen some day. It's what Europeans in the 2010s called "austerity" and it always makes some people scream but this graph:

https://fiscaldata.treasury.gov/americas-finance-guide/natio...

... is not sustainable. Up to 1984 overall US debt was stable. Since then its growth rate became dangerous. Debt/GDP ratio is now worse than just after WW2. The federal government is currently spending more on interest than on defense or Medicare:

https://www.crfb.org/blogs/interest-costs-have-nearly-triple...

The US is currently getting its first taste of what parts of Europe started going through in 2008, and unfortunately there's bad news: the cuts you're seeing now are mostly cosmetic. They're what can be done within the current framework of laws, sort of, with lots of bending of the rules and creative interpretations of them and maybe some oversteps. But it's just the start of what's needed. Large scale reform of the laws themselves will be required regardless of whoever wins the next elections.