Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE program faces swift end after DHS fails to renew contract [updated]

csoonline.com

Post reply on HN
Print view View original

951–960 of 1001 posts

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#951

Post by mmooss »

watwut wrote: post #404
mmooss wrote: post #126

Earlier quoted context omitted.

> Your words don't make any sense in this environment. The idea that any person at an agency could stand up to or convince the DOGE team of anything is preposterous. Your comment embraces and spreads the powerlessness they want you to feel and spread. Of course you can stop them - like any other negotiation in life, especially non-friendly ones, you need to make it in Trump's interest either by carrot or stick. Trump…

No, blaming "someone inside DHS" is what makes no sense. It 100% makes sense to blame DOGE and actual perpetrators. You can stop them only if you start to blame those who do the stuff you dont like instead of blaming everyone else except them.

Why wouldn't you blame Trump?

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#952

Post by porridgeraisin »

goku12 wrote: post #943
porridgeraisin wrote: post #929

Earlier quoted context omitted.

Likening CVE database maintainers to natural disaster response teams and an entire country's medical board is quite the achievement in hyperbole, congratulations. Anyway, my opinion is that CVEs have a very low signal-noise ratio and vulnerability databases in general should be revamped to try and fix that problem. The current system - I don't claim to know the root cause - is simply horrible. It could be the managem…

Hyperbole according to whom? Clearly, this forum full of tech professionals seem to disagree with you. And I listed those arguments to show how hollow your own argumentation is - not to draw a parallel. But even with that straw-man, how did you decide that such a database has no serious utility to the governments and private institutions worldwide? And what's even worse is how some people belittle others' work withou…

> how did you decide that such a database has no serious utility to the governments and private institutions worldwide

I did not. I said that the signal noise ratio has to be improved. I explicitly used the word "revamp". I know, hyperbole low reading comprehension.

> So perhaps what's needed to improve their quality is to increase their funding, not cut it further.

Sure, if that is the blocker, funding them more is fine by me.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#953

Post by Sohcahtoa82 »

senectus1 wrote: post #57
rqtwteye wrote: post #26

Earlier quoted context omitted.

I think it’s ignorance and arrogance. The US seems to be on a path to lose technological and science leadership. The current leadership doesn’t seem to understand things that aren’t flashy. I wonder when they’ll dial back on food safety. I am sure RFK knows some vitamins that protect against salmonella

the guy is ultimate small gov. he wants to rip it out by the roots.

If you truly believe this, you don't know what small government means.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#954

Post by mike_hearn »

rco8786 wrote: post #882
mike_hearn wrote: post #756

Earlier quoted context omitted.

But, why is there no profit incentive to do this when for-profit companies are already doing so? https://github.com/advisories Note that many of these entries start with GHSA not CVE. Agree that the military budget should face large cuts too, unless I guess a major war breaks out.

They are doing it, but there's no profit incentive. Github is a bit of a special case because of their commitment to OSS and the broader engineering community, but the moment a downturn occurs and MS takes a harder look at P&Ls, you better believe that's on the chopping block. The public sector is exactly where you need things that are important to society but don't make money.

There's a profit incentive: GitHub sells its services. The free stuff is an advert.

At any rate, even if they give it away for altruistic reasons, Microsoft is a sustainable going concern that brings in more than it spends. It can afford charity. The US government isn't and can't.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#955

Post by dang »

jeff_carr wrote: post #721

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

Thanks. It's always a puzzle what to do with threads based on articles that have since been superseded by later developments. Do we start a new thread based on a new article? The new article / thread usually fails to do very well, partly because there just was a big discussion, and partly because hearing about something getting fixed is less interesting and exciting than the original stimulus.

I've been playing recently with putting [fixed] at the end of the original title to indicate this sort of state change to the reader. Not sure if that's the best way, nor if the situation has genuinely been fixed or not, but I guess it's better than nothing. Swapping out the article and title would probably be too much of a rug pull on the existing thread.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#957

Post by SpicyLemonZest »

Latty wrote: post #488
SpicyLemonZest wrote: post #365

Earlier quoted context omitted.

Organizing mass protests isn't something you do instead of organizing electoral opposition. Even in countries that haven't had fair elections for a while, people generally still organize opposition and talk about how they're going to vote. The best way to ensure your opponents retain power is to go around telling people it's too late and they've already won.

I'm not saying people should not organise to vote, I'm objecting to the framing of "in four years this will be over" or "in four years we can fight this", if you are waiting for elections to solve this alone, that's a mistake. Elections alone won't be enough. It's not too late to do anything, it is too late for just voting against it to be enough.

I agree that elections alone aren't enough, but the question of whether you expect a chance to reset in 4 years affects a lot of strategic calculations. If you expect Trump will face democratic accountability in 2026 and 2028, it makes sense to focus on things like tariffs that a lot of voters will find mildly uncomfortable. If you don't, any energy you spend on things that don't produce mass mobilization is wasted.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#958

Post by dang »

dang wrote: post #955
jeff_carr wrote: post #721

The contract with MITRE has been extended. https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-... My guess indefinitely. DOGE might be a bunch of idiots, but in the entire DOD, there are non-idiots.

Thanks. It's always a puzzle what to do with threads based on articles that have since been superseded by later developments. Do we start a new thread based on a new article? The new article / thread usually fails to do very well, partly because there just was a big discussion, and partly because hearing about something getting fixed is less interesting and exciting than the original stimulus. I've been playing recen…

Previous examples of this for anyone curious:

NIH.gov DNS servers down, making PubMed, BLAST, etc. unreachable [fixed] - https://news.ycombinator.com/item?id=43229201 - March 2025 (385 comments)

Mozilla site down due to "overdue hosting payments" [fixed] - https://news.ycombinator.com/item?id=43226089 - March 2025 (102 comments)

Ask HN: Stripe Atlas messed up my 83B election what do I do? [fixed] - https://news.ycombinator.com/item?id=40825802 - June 2024 (3 comments)

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#959

Post by goku12 »

porridgeraisin wrote: post #952
goku12 wrote: post #943

Earlier quoted context omitted.

Hyperbole according to whom? Clearly, this forum full of tech professionals seem to disagree with you. And I listed those arguments to show how hollow your own argumentation is - not to draw a parallel. But even with that straw-man, how did you decide that such a database has no serious utility to the governments and private institutions worldwide? And what's even worse is how some people belittle others' work withou…

> how did you decide that such a database has no serious utility to the governments and private institutions worldwide I did not. I said that the signal noise ratio has to be improved. I explicitly used the word "revamp". I know, hyperbole low reading comprehension. > So perhaps what's needed to improve their quality is to increase their funding, not cut it further. Sure, if that is the blocker, funding them more is…

> Good. CVEs were the poster boy of goodharts law for the longest time.

I guess this must have been by somebody else who thinks it's OK to shutdown CVE db because it isn't good enough for them.

> I know, hyperbole low reading comprehension

Try starting with the list in my first reply. Reading comprehension comes later.

> Sure, if that is the blocker, funding them more is fine by me.

Perhaps you should have started with that first before belittling their work. This is exactly what I have been saying all along.

Re: CVE program faces swift end after DHS fails to renew contract [updated]

#960

Post by GolberThorce »

cantrecallmypwd wrote: post #653
benatkin wrote: post #194

Earlier quoted context omitted.

It's a legitimate term. It's like criticizing use of the word startup or demanding someone put a dash in frontend or backend .

Thank you for the unsolicited defense. Linguistic bikeshedding is tantamount to an ad hominem. It's the mark of someone unable or unwilling to form a rational, valid argument or engage in civil discourse. Let's instead refocus to the HN site guidelines please. :o)

[dead]
Post reply on HN