Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

Post reply on HN
Print view View original

641–650 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#641

Post by brightball »

strogonoff wrote: post #376
dmckeon wrote: post #346

Earlier quoted context omitted.

People trying to ignore politics are like fish trying to ignore water.

Not talking about politics is itself a political position (in favor of status quo).

No it’s not. It’s a position that comes from experience of knowing that it’s a complete waste of time because nobody’s mind is being changed.

Further, there are entire segments of political groups who just want to assume your beliefs like a political straw man so they can denigrate you.

It’s an unhealthy waste of time and that doesn’t truly hit you until you invest the time in talking to an otherwise rational person, provide the closest thing to proof of your perspective in a situation and then watch them deny it anyway.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#642

Post by skywhopper »

franktankbank wrote: post #553
pjc50 wrote: post #449

Earlier quoted context omitted.

Apart from the few maniacs On Here who seek out the unregulated intentionally. Raw milk (all those tasty diseases). "Research chemicals" (don't hear so much about that lately, but there were whole microdosing fads).

Raw milk is delicious, my ancestors have been drinking it for millennia.

And many of them died from doing so.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#643

Post by rco8786 »

ggm wrote: post #51

I wish this hadn't happened. I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do t…

> I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides?

Come on, are you living under a rock right now? There are massive indiscriminate funding cuts to anything that Elon/Doge deems to be "fraud", and they explicitly do not care about the collateral damage.

This is not about the DHS or "compartmentalization". This is just a politician running amok and having real consequences.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#644

Post by dev_l1x_be »

cookiengineer wrote: post #209

If there are any Europeans here, I'd love to make my vulnerability database that's accumulated from all linux security trackers and the CVE/NVD open source if I can manage to find some folks who'd help with maintenance. Currently hosting costs are unclear, but it should be doable if we offer API access for like 5 bucks / month for private and 100 / month for corporate or similar. Already did a backup of the NVD in th…

We should host it and collect membership fee from people who need this data. This way we can make it resilient against lack of government support. I would love to pay 5-10EUR/month to use such a service.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#645

Post by rickdeckard »

cookiengineer wrote: post #571
croes wrote: post #481

Earlier quoted context omitted.

https://www.enisa.europa.eu/news/another-step-forward-toward...

> https://euvd.enisa.europa.eu/ They already did it. Great! Maybe we can ask them how to contribute to their software, as it seems to be proprietary at the moment? edit: lol, their manifest.json is still the React boilerplate: https://euvd.enisa.europa.eu/manifest.json Their database seems to also only contain fairly recent CVEs (up until 2019? some CVEs are missing...) and not before that

To quote the article

  "Fourth, national vulnerability databases like China’s and Russia’s, among others, will largely dry up (Russia more than China)."

  "Fourth [sic], hundreds, if not thousands, of National / Regional CERTs around the world, no longer have that source of free vulnerability intelligence."

  "Fifth [sic], every company in the world that relied on CVE/NVD for vulnerability intelligence is going to experience swift and sharp pains to their vulnerability management program."

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#646

Post by rco8786 »

eadmund wrote: post #566
ggm wrote: post #51

I wish this hadn't happened. I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do t…

> I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? The National Vulnerability Database has been unable to keep up with the flow of CVEs for over a year now: - https://anchore.com/blog/national-vulnerability-database-opa... - https://www.cyberreport.io/news/cve-backlog-update-the-nvd-s... - https://www.ibm.com/think/insights/cve-backlog-update-nvd-st...…

> perhaps the thinking is to radically change approaches?

If there had been a replacement or reform plan for even one single iota of the things this admin has cut, I might give them the benefit of the doubt. But there's not. It's just kill, kill, kill.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#647

Post by dev_l1x_be »

jonnybgood wrote: post #306
Ucalegon wrote: post #267

Earlier quoted context omitted.

The EU should just buy MITRE. Move it to the EU and make it a EU based project.

MITRE is a non-profit. All the EU has to do is reach out to MITRE and be willing to fund the project.

Non-profit means (in this case) payed by somebody who does not have anything to say about the transaction. It would be better to pay for it so that people who are interested in this subject have a say.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#649

Post by pif »

4ndrewl wrote: post #296

To the "I wish HN would stay out of politics" crew. You can stay out of politics, but politics will always come and find you.

There's politics and there are facts.

Trump voters are stupid. This is a fact.

Right or left leaning, that's politics.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#650

Post by [deleted] »

user_7832 wrote: post #580
franktankbank wrote: post #553

Earlier quoted context omitted.

Raw milk is delicious, my ancestors have been drinking it for millennia.

Isn't this literally survivorship bias? Those who died early wouldn't have had offspring. 1 - https://en.wikipedia.org/wiki/Survivorship_bias

[deleted]
Post reply on HN