Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

791–800 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#791

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

[flagged]

Opinions vary widely on whether that is the case.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#792

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

But the article says, quote:

> It’s unclear what led to DHS’s decision to end the contract after 25 years

and then suddenly it gets extended. What does it have to do with DOGE?

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#793

Earlier quoted context omitted.

I can't believe what a bunch of bollocks this administration is. I couldn't believe it the first time, and this time I thought "Well at least I'm ready, it will be a lot like last time" and it's so much worse

> it will be a lot like last time A lot of people seemed to have had this theory, despite all the evidence to the contrary.

There wasn't any evidence, that's the problem.

It was all opinion. Trump said a lot of stuff before this election, but he said a lot of stuff before his first one too.

When people disagreed on what he might do, it was all guesses. There was no evidence to base anything on. Would his second term be restrained by people around him like in his first? That would be an evidence-based extrapolation. Would tariffs be all talk and little action, like in his first term? Extrapolating from evidence, they would be. But 2025 isn't 2017. Things would be different, but how? It's all guesses.

It's only hindsight that is 20/20.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#794
post #51

I wish this hadn't happened. I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do t…

This sort of thing is happening across the federal government. There is no rhyme or reason. DOGE has been given an unrealistic target for cuts and they're desperately cutting whatever they can get their hands on. If you look at the federal budget it's nearly impossible for DOGE to hit their stated goals without touching benefits like medicare and social security (which are off limits so far) so the only option is dee…

Something different like gay people, women, immigrants all suffering while they laugh. Who's laughing now? From an outsiders perspective, I sincerely hope that Republicans get to feel a fraction of what these usually marginalised groups feel every day.

You'd think that lessons would incite learning but that has never seemed to be the case throughout history.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#795

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

[flagged]

This is DHS, not DOD.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#796

To the "I wish HN would stay out of politics" crew. You can stay out of politics, but politics will always come and find you.

HN can stay out of politics just fine for the most part. If a political topic comes into tech we can talk about it then, and stay out of other crap that insufferable people drag in because "there's no such thing as being neutral" or whatever.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#797
post #739

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consortium. (If you did not notice they operate zero budgeting approach: cut everything and if something is very important reverse it. But you cut first and then ask questions.) It’s worth noting that MITRE is a DoD contractor (with minor contracts from other agencies…

... and that industry led consortium will have a board all paid princely sums, and an executive leadership team that is conflicted to the hilt and paid kingly sums, and they will charge exorbitant rents in order to keep the lighthouse lit.

There's flaws with every approach, but I much prefer the approach where this sort of thing is treated as a public good, rather than as yet another soon-to-be walled garden.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#798
post #239

Earlier quoted context omitted.

I disagree that it is Way Better than before. A judgement call is worth more than a team wasting effort chasing irrelevant pseudo-vulnerabilities being reported as vulnerabilities. A broken yardstick is worse than no yardstick.

But that's an issue organizations bring upon themselves, by defining semi-arbitrary KPIs that are used without proper interpretation. It's not directly caused by CVEs or assigned scores. It's like blaming git that it count lines in diffs, because your company created a KPI that measures developer's based on LOC changes.

Fair point. I was not blaming CVE for the situation, simply bemoaning the situation.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#799

Earlier quoted context omitted.

No thank you. I am absolutely uninterested in civil discussions with people who literally want to kill me and deport my good friends to guantanamo bay cuba. When you accept nazism you throw the concept of civil discourse out the window.

Case in point: you have decided that those who disagree with you want to kill you, deport your friend, and are otherwise nazis. While a minority do, that isn't the majority.

Why can't we talk plainly to each other anymore? Can we not talk in loaded statements and projection?

They have valid concerns, and taking steps to minimizing those concerns is just muddying the water in favor of those using political violence against people who don't deserve it.

There's a lot of counter-intel campaigns flying around all at once, and a lot of them are curated to infect brains of people who are willing to accept fascism.

"Well, they're not completely nazis... so you're wrong for likening them to nazis!"

"Well, you've decided to shut off discussion to people opening your mind about the impending fascism. That must mean you're not fit for discussion"

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#800

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

[flagged]

I don't know if this is a Poe's Law situation or not, so apologies if this is a satirical bit, but I'm horrified by the idea that you may be serious.
Post reply on HN