oss-security - Re: !CVE: A new platform to track security issues not acknowledged by vendors

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231108231309.GA10833@openwall.com>
Date: Thu, 9 Nov 2023 00:13:09 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: !CVE Team <contact@...cve.org>
Subject: Re: !CVE: A new platform to track security issues not acknowledged by vendors

Hi,

I don't like to reject messages (and so far haven't rejected any in this
thread), but let's please only post when we have something valuable to
add, which also fits the topic of this list.  In this thread, when
you're not CC'ing the OP (which I've re-added here), they probably won't
even see your comments.

On Wed, Nov 08, 2023 at 12:46:13PM -0800, Jean Luc Picard wrote:
> I have a number of natsec-ey google reports that went nowhere didnt't get
> credit or a dime out of it.  Most are nullified by the current state of
> affairs struck by xAI (ie how to cook crack) but others I still feel should
> be looked at by the greater community.  Is this the apprapriate aggregate
> platform now?

You write "natsec-ey".  That feels off-topic here.  So is your message
actually off-topic and should have been rejected?   No need to reply,
just please apply the "is my message on-topic" filter before you post.

In general, if you've found something valuable, just share it where
appropriate - if it's a vulnerability in Open Source software, please
post in here.  You don't need a CVE for this, nor any CVE alternative.

On Wed, Nov 08, 2023 at 03:55:53PM -0500, Brian Peters wrote:
> What about NVID? NVID-2023-0001
> Not (A) Vulnerability ID

Now that reads like pun on NIST's NVD.

We can come up with lots of other suggested names (and I had made some
suggestions too), but I think we don't need to continue much further.

So let's wind this thread down unless there's something truly new and
on-topic to add.  I'll start rejecting messages if I have to.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.