CVE program faces swift end after DHS fails to renew contract [updated] • Hacker News Board

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#941

Post by mrguyorama » Wed, Apr 16, 2025, 6:28 PM UTC

petesergeant wrote: post #889

giraffe_lady wrote: post #775

Earlier quoted context omitted.

I just don't see how it is universally so, frankly. As a general guideline sure but some discernment is necessary nothing is gained from steelmanning apartheid or the third reich or torture prisons or or you see my point I hope.

How can you argue effectively against something if you don't understand the strongest version of the argument _for_ it?

Exploiting the need to invent a "logical" reason to do something illogical is the exact attack vector that the Gish Gallop uses to fuck over people.

Like you get that right? This administration does not discuss or debate, it shits out lies and laughs as people play make believe high school debate games, and give them infinitely more effort than they did.

There is no such thing as "effectively arguing" against a Gish Gallop, that's it's entire purpose.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#942

Post by Sohcahtoa82 » Wed, Apr 16, 2025, 6:32 PM UTC

AlexandrB wrote: post #705

01HNNWZ0MV43FF wrote: post #133

Earlier quoted context omitted.

A lot was lost in the midterms and Supreme Court appointments. Hopefully these 4 years energize people to vote. I know protesting and direct action and so on are also important, but the gradient is not negative for voting for every office you can vote for in every election.

> Hopefully these 4 years energize people to vote. This euphemism has to end. I think you mean: "Hopefully these 4 years energize people to vote Democrat". Why not just say it plainly instead of using supposedly non-partisan language? This neutral phrasing seems to be an appeal to a "silent majority" that agrees with you and disagrees with Republican leadership. What if that silent majority doesn't exist?

You're right in that it's possible that the silent majority doesn't exist.

But personally, the reason I believe it does exist is two-fold:

1. The "My vote won't change anything" rhetoric only ever gets expressed by left-leaning people.

2. Only left-leaning people require endless purity tests for their political candidates and will refuse to vote for anybody that they don't think is the perfect candidate. These are the ones that talk about being fed up for having to choose between the lesser of two evils, then look like a Surprised Pikachu when Trump wins.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#943

Post by goku12 » Wed, Apr 16, 2025, 6:41 PM UTC

porridgeraisin wrote: post #929

goku12 wrote: post #682

Earlier quoted context omitted.

Ah! Another one to add to the following list: - What disease did the CDC ever prevent? - What improvement did the NHTSA ever bring to full self driving? - What improvement in airline safety did the FAA bring? - What good did FEMA do in any disasters? I don't want to quip about how their achievements are invisible because they prevented the disasters that would have brought the spotlight on them, even when they were t…

Likening CVE database maintainers to natural disaster response teams and an entire country's medical board is quite the achievement in hyperbole, congratulations. Anyway, my opinion is that CVEs have a very low signal-noise ratio and vulnerability databases in general should be revamped to try and fix that problem. The current system - I don't claim to know the root cause - is simply horrible. It could be the managem…

Hyperbole according to whom? Clearly, this forum full of tech professionals seem to disagree with you. And I listed those arguments to show how hollow your own argumentation is - not to draw a parallel. But even with that straw-man, how did you decide that such a database has no serious utility to the governments and private institutions worldwide? And what's even worse is how some people belittle others' work without getting even the basic facts right. You neglected the fact that they were underfunded to begin with. So perhaps what's needed to improve their quality is to increase their funding, not cut it further. That's a trick used by some sleazy politicians to justify de-funding and privatizing useful endeavors like these. I find such excuses to be quite dishonest to begin with.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#944

Post by phtrivier » Wed, Apr 16, 2025, 6:42 PM UTC

Latty wrote: post #770

phtrivier wrote: post #686

Earlier quoted context omitted.

I understand you have elections in two years, don't you ? I don't know if a complete reversal congress is possible. That would be a good litmus test. "They" have not prevented special elections so far ; if "They" need to prevent the next one, whatever they try will happen then, I suppose ?

I'm British, but I think to expect free and fair election in the US in two years is to stick your head in the sand. I don't see them preventing elections, but just rejecting or altering results that don't support them: the litmus test is already triggered: the special election in North Carolina has an ongoing court case trying to throw out ballots to allow the Republican to win. They have also pushed a executive orde…

I missed the North Carolina part. Do you think the judges will play ball here too ?

If you can't vote your representative out of office, then, well, yeah, you're not really in a democracy anymore.

I guess you can always incorporate and sell bitcoins - then, you have a chance to buy your élections.

Or, admit that you now leave in a dictatorship, and thank your maga neighbors for that.

At some point, both Presidents Musk and Trump die of old age, and a window of opportunity for change opens.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#945

Post by johnnyanmac » Wed, Apr 16, 2025, 6:49 PM UTC

CamperBob2 wrote: post #178

cantrecallmypwd wrote: post #90

Earlier quoted context omitted.

Vampire capitalism. They want civilization to break down so they can offer a solution for profit. The enemies of all people and life on the planet are a tiny group of oligarchs and their supplicants.

This isn't capitalism, any more than arson, burglary, or extortion is capitalism. Get some new material.

It's malicious rent seeking. Is that capitalism? Once you run out of easy problems to solve, you create problems for yourself to solve.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#946

Post by goku12 » Wed, Apr 16, 2025, 6:51 PM UTC

gryfft wrote: post #236

goku12 wrote: post #160

Earlier quoted context omitted.

It's more likely to boost the zero day black market. I don't know if I want to attribute this to idiocy (indiscriminate cost cutting), greed (contracts for their crony pals) or malice (hoarding and trading 0 days).

¿Por qué no los tres?

I don't know Spanish. So I used an online translator. I can see how greed and malice can go together. But idiocy? I don't know.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#947

Post by ygjb » Wed, Apr 16, 2025, 6:58 PM UTC

ThinkBeat wrote: post #809

nxobject wrote: post #783

Earlier quoted context omitted.

I’m a little hesitant to trust a CVE database operated by private industry on the grounds of conflict of interest for that reason, too.

I am quite hesitant to trust the DOD to keep track of software vulnerabilities. Some parts are developing and exploiting vulnerabilities. And given a fresh feed of what people find, and usually a delay from notification until publication, which may sometimes just be a bit longer of a delay, would allow the DOD to weaponize the vulnerability for their own use as well.

This illustrates a misunderstanding of how CVE functions. It's a repository of data about disclosed vulnerabilities (even if some disclosures are embargoed and not yet published - if anyone but the bughunter and dev team that owns the fix knows about it, it's disclosed :P). The actual vulnerability discovery process is external and done by individual researchers, teams and businesses who report vulnerabilities to the appropriate groups called CVE numbering authorities (CNA) who manage the assignment and publication of CVE data through their scopes. There is not much technical advantage in terms of advance disclosure since the CNA controls what data goes to CVE.

As an example, a CNA like Mozilla, Apple, or Microsoft is unlikely to disclose vulnerability data via CVE until they have remediated the issue or have public guidance, and their embargo processes are likely separate from CVE publication.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#948

Post by mmooss » Wed, Apr 16, 2025, 7:11 PM UTC

figgis wrote: post #187

mmooss wrote: post #153

Earlier quoted context omitted.

> DOGE is doing this, it's not a "scapegoat", and Trump is not going to negotiate anything here, that's ridiculous. DOGE follows Trump's direction and acts on his behalf, as you must know. They make a big deal out of DOGE so Trump's name is less attached to these actions. Then they can take much of the blame with them when they go away, with Trump and the GOP blaming them for 'excesses'. > Trump is not going to negot…

Currently the "discussion of leverage" you are talking about is out of the hands of the leaders who run these programs. The amount of disrespect you have shown for someone that is just telling you 99% of federal workers have absolutely no leverage says a lot.

> Currently the "discussion of leverage" you are talking about is out of the hands of the leaders who run these programs.

That's an assertion without any any argument. It means nothing.

> The amount of disrespect you have shown for someone that is just telling you 99% of federal workers have absolutely no leverage says a lot.

What does it say? Why is such a person somehow special?

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#949

Post by mmooss » Wed, Apr 16, 2025, 7:12 PM UTC

throitallaway wrote: post #190

mmooss wrote: post #153

Earlier quoted context omitted.

> DOGE is doing this, it's not a "scapegoat", and Trump is not going to negotiate anything here, that's ridiculous. DOGE follows Trump's direction and acts on his behalf, as you must know. They make a big deal out of DOGE so Trump's name is less attached to these actions. Then they can take much of the blame with them when they go away, with Trump and the GOP blaming them for 'excesses'. > Trump is not going to negot…

> You need to make it in Trump's interest to keep the CVE program. This guy is ~80 years old and bragged about "person, woman, man, camera, TV." He recently got into a Tesler and exclaimed "everything's computer!" Have you seen the way his aids explain executive orders to him (like a child) before he signs them? He doesn't have the foggiest notion of comprehension of what the CVE program is, or how it would benefit h…

He's convinced you to quit and let him do whatever he wants. That's the problem.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#950

Post by mmooss » Wed, Apr 16, 2025, 7:14 PM UTC

chris_wot wrote: post #191

mmooss wrote: post #126

Earlier quoted context omitted.

> Your words don't make any sense in this environment. The idea that any person at an agency could stand up to or convince the DOGE team of anything is preposterous. Your comment embraces and spreads the powerlessness they want you to feel and spread. Of course you can stop them - like any other negotiation in life, especially non-friendly ones, you need to make it in Trump's interest either by carrot or stick. Trump…

No, it's definitely DOGE doing all of this. Each one of these young fools need to be named and shamed. The level of damage they have done is unprecedented. They will, in their later years, hopefully look back at this time in their life with a great deal of shame and embarrassment.

You don't think they are carrying out Trump's goals? They are just working independently? The great similarity between their actions and Trump's goals and methods is coincidental?

Why are you protecting Trump, the President, from responsibility?