Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

831–840 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#831

Earlier quoted context omitted.

So you trust industry now?

Same question would be for government funded agencies.

No, because the gov funded agencies don't have a personal stake in the outcome.

That's why industry regulating itself doesn't work, and why government regulations exist.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#832
post #51

I wish this hadn't happened. I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? I ask this, because I don't think anyone in the subject matter specialist space would have made a strong case "kill it, we don't need this" and I am sure if asked would have made a strong case "CRISSAKE WE NEED THIS DONT TOUCH IT" -But I could believe senior finance would do t…

> I wonder what level of compartmentalisation inside DHS means they didn't see this as having sufficient downsides? The National Vulnerability Database has been unable to keep up with the flow of CVEs for over a year now: - https://anchore.com/blog/national-vulnerability-database-opa... - https://www.cyberreport.io/news/cve-backlog-update-the-nvd-s... - https://www.ibm.com/think/insights/cve-backlog-update-nvd-st...…

Cutting the program would seem to go in the opposite direction of what is needed.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#833

Earlier quoted context omitted.

$44M/year? https://www.usaspending.gov/award/CONT_AWD_70RCSJ23FR0000015...

Totally worth cancelling then. Some volunteer will set up a GitHub pages and mailing list to fulfill the same duties.

Or 10 people will create that list and nobody will use any of them. The whole point here is that the CVE program had the network effect of being the defacto list of issues but now that's been pissed away.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#835

Earlier quoted context omitted.

No thank you. I am absolutely uninterested in civil discussions with people who literally want to control everything I say and put my good friends into reeducation camps. When you accept communism you throw the concept of civil discourse out the window.

Democrats haven't put anyone into a reeducation camp as far as I'm aware. Your enemies are imaginary while the parent comment's enemies are all too real.

Yes, but the Republicans literally want to kill some minority groups. /s

Do you know how crazy this all sounds once you're outside of a specific left echo chamber? How is the hyperbole I employed any more unbelievable than that of the poster I was replying to? Another sibling comment to yours says that Trump is rounding up political opponents for a gulag. Nevermind that he has only rounded up non-citizen (most of them in the US illegally) because that's all he can do.

If you look at my posting history, it's wildly left-wing as little as 2 years ago. I've become completely disillusioned with the left after noticing how self-contradictory some of those ideas are and how the language of crisis is deployed to constantly smear their political opponents. Everyone the left doesn't like is Hitler and every policy they don't like is fascism. Give me break.

Edit:

For a little more elaboration, look at the speech codes and compelled "DEI pledges" that American universities have employed in the last few years[1]. How is this not speech policing? You might argue that these are private institutions, and maybe that's fair enough, but when the government pulls funding for crap like this the hyperbole and outrage persist.

Or look at Canada's bill C-63[2]. This bill aims to allow the possibility of life sentences for "hate speech"[3]. To me this is authoritarian. To many left wing commentators, it's another day at the office, I guess - meanwhile the Canadian right wing party is regularly called fascist[4][5] despite being basically in line with US Democrats on many issues.

[1] https://unsafescience.substack.com/p/the-last-four-years-wer...

[2] https://www.parl.ca/DocumentViewer/en/44-1/bill/C-63/first-r...

[3] https://bccla.org/2024/09/whats-in-bill-c-63-why-are-we-alar...

[4] https://medium.com/pigeons-peculiarities/pierre-poilievres-p...

[5] https://cultmtl.com/2025/02/pierre-poilievre-has-racked-up-e...

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#836
post #739

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

My guess is that they’ll be phased out next year. The long-term goal seems to be transitioning the CVE program into something more like an industry-led consortium. (If you did not notice they operate zero budgeting approach: cut everything and if something is very important reverse it. But you cut first and then ask questions.) It’s worth noting that MITRE is a DoD contractor (with minor contracts from other agencies…

> Having the CVE program operated by a company funded by the U.S. military

...Yep, we're done as a democracy. Pack it up, boys.

Edit: I know it is doom and gloom but the CVE program could easily delay information and leave holes on purpose.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#837
post #350

only one country pays but all benefit from it. It should be funded by all who benefit like UN.

I thought most people in the US wanted the UN to have less control over this stuff? Remember the talk about moving control of the Internet to the ITU (International Telecommunication Union)?

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#838

Earlier quoted context omitted.

> it will be a lot like last time A lot of people seemed to have had this theory, despite all the evidence to the contrary.

There wasn't any evidence, that's the problem. It was all opinion. Trump said a lot of stuff before this election, but he said a lot of stuff before his first one too. When people disagreed on what he might do, it was all guesses. There was no evidence to base anything on. Would his second term be restrained by people around him like in his first? That would be an evidence-based extrapolation. Would tariffs be all ta…

[flagged]

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#839

Earlier quoted context omitted.

[flagged]

A bit disingenuous; he also had a career as a soldier.

There is a massive difference between having a career as a soldier and knowing how to lead one of the world's largest organisations (the DOD)

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#840

Earlier quoted context omitted.

... and that industry led consortium will have a board all paid princely sums, and an executive leadership team that is conflicted to the hilt and paid kingly sums, and they will charge exorbitant rents in order to keep the lighthouse lit. There's flaws with every approach, but I much prefer the approach where this sort of thing is treated as a public good, rather than as yet another soon-to-be walled garden.

I keep thinking of that time Wisconsin's state government privatized a bunch of IT stuff in the interest of "government efficiency", and the cost taxpayers paid for those specific functions increased by several hundred percent while quality of service went down. At that same time, though, I worked for a contractor that I do believe saved states money compared to doing things in-house. The work we did really required…

For every example of privatization going wrong, there's least one example (if not two) of it going right.

But serious question -- what is the difference these days anyways? Our entire government is effectively privatized anyways from the local level up to the federal. We rely on contractors for almost everything that matters. We just maintain this facade that they are not privatized.

Post reply on HN