[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170210224910.neeqi3e5265dgnxh@sentinelchicken.org>
Date: Fri, 10 Feb 2017 14:49:10 -0800
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Subject: Re: MITRE is adding data intake to its CVE ID process
> This is a fine supplement to the oss-security list, but it completely
> removes the possibility of natural discussion of CVEs by members
> of the list. Valuable insights might never surface unless every list
> member manually monitors the database and decides to send a
> message regarding a given database entry.
>
> In short, it removes the best avenue toward the collaboration upon
> which all OSS development is based in the first place. I don't mind
> if MITRE requires submitters to use their web stuff, but messages
> generated by that tool should also appear on this list, or something
> very valuable will be lost.
It's pretty clear that MITRE's interest is increasingly aligned with
commercial software vendors and not the open source community at
large. I wouldn't hold your breath on improvements to how The MITRE
Corporation deals with our community. If you want something better,
we'll have to build it ourselves. Note that I'm just the messenger.
tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
