[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZU0aglk9Rt60nIQ-@dojo.mi.org>
Date: Thu, 9 Nov 2023 12:44:34 -0500
From: "Mike O'Connor" <mjo@...o.mi.org>
To: oss-security@...ts.openwall.com
Cc: !CVE Team <contact@...cve.org>
Subject: Re: !CVE: A new platform to track security issues not
acknowledged by vendors
!CVE Team,
>From an open source perspective, the CNA(s) who might be assigning
CVEs might not be a "vendor". As just one example, the GitHub CNA
assigns tons of CVEs for open source software using GitHub's Security
Advisories, but I wouldn't think of GitHub as a "vendor" for all the
projects they host. How do you deal with CNAs who might be fine with
assigning a CVE, but tagging it as DISPUTED? Perhaps they don't want
to build deprecated decades-old code to scope out the severity of a
buffer overflow some random fuzzbot found. How would !CVE work for
the Linux kernel, where most security fixes have git commit hashes but
not CVEs? You don't seem resourced for that.
Overall, it seems like the prbolem you're trying to solve is "I'm not
getting my unique tag from CVEs CNAs for my vulnerability". Your fix
is "some other unique tag mechanism for vulnerabilities". I think I
see where this might be going:
https://xkcd.com/927/
Have you considered, I dunno, working with the CVE folks, addressing
what CNA rules you think may be broken? Not all vulnerabilties are
created equal, and it may make sense to create more alternate systems
to deal with that. But, forking off on your own should be done with
some due diligence. The last thing the security community needsi are
even more fractured efforts, as they deal with enough fractured stuff.
My $0.02, FWIW...
-Mike
--
Michael J. O'Connor mjo@...o.mi.org
=--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"But we decide which is right... and which is an illusion." -Moody Blues
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
