[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170427153101.GA2561@openwall.com>
Date: Thu, 27 Apr 2017 17:31:01 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: MITRE is adding data intake to its CVE ID process
On Thu, Apr 27, 2017 at 08:37:51AM -0600, Kurt Seifried wrote:
> longer term the DWF will be taking this on, but like most things in tech
> there have been unexpected delays and issues. I'll keep the list appraised
> as things improve (we should start seeing progress in the next month or
> two).
Meanwhile, why don't you simply proceed to assign CVEs per requests made
in here like you do on (linux-)distros? I think this would help.
As you're aware, personally I'm not into CVEs, but I liked the
side-effect that people's desire to have CVEs brought more vulnerability
information in here. I am a bit concerned that MITRE's change may
result in us getting notified in fewer cases, especially if we continue
to redirect to MITRE those CVE requests that still arrive in here. This
is going to result in not only fewer CVE requests sent in here, but also
in fewer vulnerabilities being disclosed in here - or at least in them
being brought in here with an extra delay (after MITRE has assigned a
CVE ID and reminded the person that they should notify oss-security,
which thankfully they do).
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
