Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

591–600 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#591

Earlier quoted context omitted.

To play devil's advocate - it's horrible when gaming, programming, business or even porn forums get overrun by politics. It's not that the political topics are unimportant but all my feeds just end up looking the same as each other and the same as a newspaper app. I hate election nights because of this.

"porn forums" is a thing?

Absolutely

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#592
post #476

> A coalition of CVE Board members launched a new CVE Foundation "to ensure the long-term viability, stability, and independence of the Common Vulnerabilities and Exposures (CVE) Program." > https://www.thecvefoundation.org https://mastodon.social/@serghei/114346660986059236

This kind of a consortium needs to explicitly avoid being captured by both the product vendors (who could be incentivised to manipulate the CVE issuance process to support their own remediation timescales), and by security companies (who could be incentivised to obtain a competitive advantage via preferential access to the CVE database).

It isn't impossible for a commercially-funded organisation to avoid this kind of capture, but it isn't easy either. My mind immediately jumps to the relationship between the Mozilla Foundation and Google.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#593
post #424

To the "I wish HN would stay out of politics" crew. You can stay out of politics, but politics will always come and find you.

This quote is essentially unworkable. Everything you say, or choose not to say, inevitably advances some political perspective over another. What we should really aim for is thoughtful, civilized, and maybe even aesthetically pleasing discourse. That’s what educated people strive for. Trying to “avoid politics” is like collecting seashells while a tsunami is rolling in.

Agreed. Those who don't care about politics are doomed to be ruled by those who care.

Moreover, avoiding politics is impossible. It's all around you. Labor, entertainment, food, housing. Burying your head in the sand will only get you to have your ass in the air.

Maybe "be polite" should be a better rule than "avoid politics".

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#594

I'm surprised that it was USA's responsibility to fund this in the first place. Why weren't other countries providing funds?

Because, contrary to popular views, there is no "government of the world".

So, since the US government needed that (it provides security to US businesses), they organised and funded it (as everything else, with US taxpayers money, and savings from investors in US and abroad.)

Now, the US government decided to commit temporary-seppuku, so a number of things will happen:

* state-level government will use their local-taxpayer money to fund similar efforts (with duplication of effort), or share it with everyone

* another country or block of country will do it, and decide whether they want to "share". (I suppose Russia and China have more of an incentive to keep their CVE DB private, given their level of dis-integration with US economy ? EU maybe ?)

* an international, ad-hoc organisation is created to share the funding (something like NATO.) Multi-latteralism is not exactly in fashion this days, but if EU does it, it will be "international" by design since we're not really a federation ; so, states in "Southern Canada" are welcome to join.

* or none of that happens, the CVE db rots for a while, until a sufficiently embarrassing cybersecurity problem occurs, and the CVE db is deemed worthy of the "10% you need to bring back" by President Elon.

Pray your company, families and friends are never on the wrong side of the "reverse-Chersteron's fence".

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#595
post #481

Earlier quoted context omitted.

https://www.enisa.europa.eu/news/another-step-forward-toward...

> https://euvd.enisa.europa.eu/ They already did it. Great! Maybe we can ask them how to contribute to their software, as it seems to be proprietary at the moment? edit: lol, their manifest.json is still the React boilerplate: https://euvd.enisa.europa.eu/manifest.json Their database seems to also only contain fairly recent CVEs (up until 2019? some CVEs are missing...) and not before that

We can only hope they will get enough exposure now so they can get funding to fix stuff.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#596

Earlier quoted context omitted.

To play devil's advocate - it's horrible when gaming, programming, business or even porn forums get overrun by politics. It's not that the political topics are unimportant but all my feeds just end up looking the same as each other and the same as a newspaper app. I hate election nights because of this.

"porn forums" is a thing?

i would be surprised otherwise

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#597
post #493

Earlier quoted context omitted.

oh but you forgot the mandatory time before they even start considering the tender. looking at average speed of bureaucracy in EU it will take roughly a year to set date for a meeting that will set the date for actual meeting which will decide if this will go forward or not.... (if you think i'm joking - i'm basing this on proposed EU initiative for nuclear power which started with setting a date of meeting to setup…

100% - I wonder if this is partly by design.

I'm kind of thinking of Frank Herbert's BuSab here...

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#598
post #449

Earlier quoted context omitted.

Apart from the few maniacs On Here who seek out the unregulated intentionally. Raw milk (all those tasty diseases). "Research chemicals" (don't hear so much about that lately, but there were whole microdosing fads).

Raw milk is delicious, my ancestors have been drinking it for millennia.

not everyone's ancestors

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#599

Earlier quoted context omitted.

To play devil's advocate - it's horrible when gaming, programming, business or even porn forums get overrun by politics. It's not that the political topics are unimportant but all my feeds just end up looking the same as each other and the same as a newspaper app. I hate election nights because of this.

"porn forums" is a thing?

http://twitter.com

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#600

Earlier quoted context omitted.

Not talking about politics is itself a political position (in favor of status quo).

Depends. We’re a small, very international startup and have a super strict “no politics” policy. Politics and work are not a good combination when you’re employing people from all over the world. But I would not consider it a political statement to adopt this policy.

You would have been cancelled if you said this between 2014 - 2019 at the peak of it all.

At least now you can say it out now without being downvoted into oblivion.

Post reply on HN