Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

Post reply on HN
Print view View original

661–670 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#661

Post by acdha »

spacebanana7 wrote: post #485
4ndrewl wrote: post #296

To the "I wish HN would stay out of politics" crew. You can stay out of politics, but politics will always come and find you.

To play devil's advocate - it's horrible when gaming, programming, business or even porn forums get overrun by politics. It's not that the political topics are unimportant but all my feeds just end up looking the same as each other and the same as a newspaper app. I hate election nights because of this.

I miss that, too, but the way we get there is by re-establishing democratic norms and boundaries. The United States is flirting with fascism, and globally we are seeing the fallout from that and the cascading effects of climate change, not to mention the impacts of AI on employment, surveillance and censorship, social media, etc. Keeping politics out of forums like the ones you mentioned is like keeping oxygen out of a space station.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#662

Post by gnfargbl »

tbrownaw wrote: post #654
gnfargbl wrote: post #592

Earlier quoted context omitted.

This kind of a consortium needs to explicitly avoid being captured by both the product vendors (who could be incentivised to manipulate the CVE issuance process to support their own remediation timescales), and by security companies (who could be incentivised to obtain a competitive advantage via preferential access to the CVE database). It isn't impossible for a commercially-funded organisation to avoid this kind of…

Don't some projects already issue their own CVEs?

CNAs [1] are assigned blocks of CVEs and then assign from within that block, but the system only works if there is overall administration of the CVE Program [2].

My concern is that a capture of the administration would become a capture of the entire programme. Looking at the structure, it seems possible that CISA are in a position to prevent any such capture but, given some of the recent positions taken by the US government, we'll need to wait and see how that plays out.

[1] https://www.cve.org/ProgramOrganization/CNAs

[2] https://www.cve.org/ProgramOrganization/Structure

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#663

Post by vachina »

immibis wrote: post #513
mwe-dfn wrote: post #383

Earlier quoted context omitted.

The European, GDPR compliant subnet of the Internet Computer could suit your needs. The app would be decentralized out of the box and it can't be shut down by a single entity like a traditional cloud provider or nation state. Hosting 100GB costs about 500$ per year [0]. This is not a traditional hosting provider, it's a decentralized cloud. Reach out on the forum [1] or to me if this sounds like a good fit to you (I…

Or just use a normal host where hosting 100GB costs about $60.00 per year.

My 4TiB seedbox at home costs $5 in electricity.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#664

Post by goku12 »

bslanej wrote: post #382

[flagged]

Oh! It will be even more fun when the entire infotech and infosec industry starts seething soon. Then the rest of the world will just make alternative arrangements and move on, leaving the US behind because they can't be trusted anymore. HN's reaction is just a small taste of things to come.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#665

Post by Moomoomoo309 »

jocaal wrote: post #492
po1nt wrote: post #379

Earlier quoted context omitted.

That's because we got reliant on the funds from government. Maybe it's time to break the dependency.

> That's because we got reliant on the funds from government Not we, some people got reliant on the funds from government. It is always at the cost of someone else. The tax the rich and bourgeoisie mentality is what led to Mao Zedong and Stalin, but no-one wants to learn about history anymore.

Tax the rich mentality also led to the "golden age of capitalism" of the 1940s, 50s, and 60s. The tax rates on the wealthiest in the US at that time were huge, and that money went into job programs, housing assistance programs, construction projects, etc.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#666

Post by pseudalopex »

lolinder wrote: post #292
bruce511 wrote: post #243

Earlier quoted context omitted.

>>They thought they voted for something different Like what exactly? I mean the guy ran on cutting the budget by 2 trillion. In his last term he gave tax breaks yo the rich. Where did they think the cuts were coming from? He ran very hard on raising tarrifs. Which demonstrably raise prices (thats literally their goal.) But now people claim "I didn't vote for this." In truth they voted for him because he was the Repub…

> In truth they voted for him because he was the Republican on offer and they're die-hard Republican. The Republican party has made no secret of its agenda for decades. This is actually simply not true. The Republican party before the Tea Party looked nothing at all like this. Trump won the presidency last year riding a wave of distinctly not-your-typical-Republican lower class voters. As he rose the old guard Republ…

> The Republican party before the Tea Party looked nothing at all like this.

Starve the beast is older than the Tea Party.[1]

[1] https://en.wikipedia.org/wiki/Starve_the_beast

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#667

Post by robertlagrant »

cantrecallmypwd wrote: post #640
robertlagrant wrote: post #507

Earlier quoted context omitted.

> This sounds like looking for lemonade in a genocide. It really doesn't. This level of catastrophising has no point. It would be nice if CVE continued to exist, but it wasn't close to perfect, and perhaps it can continue in another form. There's no particular reason the US taxpayer has to sponsor global security threat tracking any more than any other taxpayer or customer.

This is also a myopic argument against funding standards bodies that support the internet. The point of having a global, shared database is a single, authoritative (more-or-less), semi-vetted repository that can hold vendor accountable externally without digital amnesia or downplaying issues, and global unique identifiers. If that takes an international nonprofit funded by bits of the free world who are okay with inv…

> This is also a myopic argument against funding standards bodies that support the internet.

No, it's the opposite. Things like this shouldn't be in the hands of a single government. They should be independent and funded by many parties. The part of your message that isn't catastrophisation is agreeing with exactly what I'm saying.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#668

Post by simpaticoder »

JackYoustra wrote: post #233

There are quite a few threads on hackernews that were cautiously optimistic about doge with, frankly, pretty naive libertarian takes about how the government works. The government is not particular (in the sense of particularism) and cannot be easily tuned to fix particular problems; rather, its best solutions come through institutional procedure and design, such as the tension between the FAA and the NTSB that, at a…

>I hope it goes remembered.

It won't be. Willful ignorance is a cornerstone of the movement. You can't lie about what you don't know. You can't have a bad take if you don't know. Upton Sinclaire said in the 1930's: "It is difficult to get a man to understand something, when his salary depends on his not understanding it." Now add to "salary" "identity", "relationships", "sense of belonging to the group". This is why critical, independent thinking, speaking truth to power, must be separately honored and encouraged by a healthy culture, because these attributes are by default mercilessly punished. (Physical courage and heroism are honored by a healthy culture for similar reasons.)

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#669

Post by Nihilartikel »

franktankbank wrote: post #553
pjc50 wrote: post #449

Earlier quoted context omitted.

Apart from the few maniacs On Here who seek out the unregulated intentionally. Raw milk (all those tasty diseases). "Research chemicals" (don't hear so much about that lately, but there were whole microdosing fads).

Raw milk is delicious, my ancestors have been drinking it for millennia.

I'd consider drinking raw milk only if I was on a first name basis with the cow that produced it.

Otherwise I would at least demand it be fermented into kefir so the food microbes can muscle out the bad.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#670

Post by ivolimmen »

spacebanana7 wrote: post #485
4ndrewl wrote: post #296

To the "I wish HN would stay out of politics" crew. You can stay out of politics, but politics will always come and find you.

To play devil's advocate - it's horrible when gaming, programming, business or even porn forums get overrun by politics. It's not that the political topics are unimportant but all my feeds just end up looking the same as each other and the same as a newspaper app. I hate election nights because of this.

If you are American and you voted for this guy -> https://www.reddit.com/r/leapoardsatemyface/
Post reply on HN