[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3440a686-5dca-fd31-70a0-4f47da438ee5@behlendorf.com>
Date: Wed, 16 Apr 2025 12:38:38 -0700 (PDT)
From: Brian Behlendorf <brian@...lendorf.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE program averts swift end
On Wed, 16 Apr 2025, Rolf Reintjes wrote:
> any comments on this?:
>
> https://www.csoonline.com/article/3963190/cve-program-faces-swift-end-after-dhs-fails-to-renew-contract-leaving-security-flaw-tracking-in-limbo.html
Dodged a bullet for now, it seems, but it'll be a long time before USG
sustainance funding for something this obvious can be taken for granted.
At this point might USG funding even be unreliable enough to account for
as a receivable on a balance sheet even in the presence of a signed
contract and for work performed.
For critical infrastructure that requires sustained funding, it seems more
important than ever to move to RAID - a Redundant Array of Independent
Donors - so as to avoid the complete and total cut-off of any one (or a
handful) of financial supporters that could collapse the system. I assume
(hope?) that MITRE is pursuing alternative sources right now; if not,
someone else should be.
Brian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
