[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160309203420.GJ1250@sentinelchicken.org>
Date: Wed, 9 Mar 2016 12:34:20 -0800
From: "Timothy D. Morgan" <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Cc: kseifried <kseifried@...hat.com>
Subject: Re: Concerns about CVE coverage shrinking - direct
impact to researchers/companies
> All - I've chatted with some of the people who fund the CVE work at MITRE.
> I've learned that CVEs *are* being issued, but obviously that is happening too slowly.
>
> They're having a meeting tomorrow (March 10) to try to figure out what
> the problems are and how to fix it. I don't know what they'll do.
> However, I'm hopeful that this will mean that the CVE work will get
> back on track soon.
Thanks David for finding the right people and raising the issue with
them. I'm sure media coverage is probably helping as well:
http://www.theregister.co.uk/2016/03/09/hackers_spin_up_alternative_cve_system_as_bugs_go_unchecked/
Suppose MITRE fixes their issues tomorrow and the CVE goes back to the
way it was. Is that really want we need going forward? A system
that's based on sending emails between humans and posting only
one-line descriptions with a series of links (half of which are broken
after a short time)? A system which tries to distribute the load by
using "big" software vendors, many of whom have a vested interest in
limiting what vulnerabilities get published in their software?
It seems like we can do better than this. Infosec hasn't been
"working" for some time. Perhaps we need better tools to help us get
ahead of the game.
--
tim
@ecbftw
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
