Re: !CVE: A new platform to track security issues not acknowledged by vendors

[!CVE Team <contact () notcve org>]

Hello all,

Thank you for your valuable feedback! We are always open to hear from 
the community and happy to improve for the benefit of all of us.

We agree with Alexander on the exclamation mark issue, it can be tedious 
when searching in the mailing lists and other sites. Also with David 
that when possible it would be good to clearly distinct names even when 
it's not legally required.

For those reasons, the !CVE team agreed to make the identifier more 
distinctive. The IDs are now NotCVE-YYYY-XXX and they are completely 
aligned to the notcve website name. So if someone is searching for 
NotCVE in the mailing list, Google, etc, will find what they are looking 
for.

Those updates are already applied and because some sites have included 
the https://notcve.org/view.php?id=!CVE-2023-0001 link (@notCVE at X, 
etc.) we are automatically redirecting only that URL to the new one 
https://notcve.org/view.php?id=NotCVE-2023-0001

Thank you all again for your feedback!

Kind regards,
!CVE Team


On 09/11/2023 00:13, Solar Designer wrote:
> Hi,
>
> I don't like to reject messages (and so far haven't rejected any in this
> thread), but let's please only post when we have something valuable to
> add, which also fits the topic of this list.  In this thread, when
> you're not CC'ing the OP (which I've re-added here), they probably won't
> even see your comments.
>
> On Wed, Nov 08, 2023 at 12:46:13PM -0800, Jean Luc Picard wrote:
> > I have a number of natsec-ey google reports that went nowhere didnt't get
> > credit or a dime out of it.  Most are nullified by the current state of
> > affairs struck by xAI (ie how to cook crack) but others I still feel should
> > be looked at by the greater community.  Is this the apprapriate aggregate
> > platform now?
>
> You write "natsec-ey".  That feels off-topic here.  So is your message
> actually off-topic and should have been rejected?   No need to reply,
> just please apply the "is my message on-topic" filter before you post.
>
> In general, if you've found something valuable, just share it where
> appropriate - if it's a vulnerability in Open Source software, please
> post in here.  You don't need a CVE for this, nor any CVE alternative.
>
> On Wed, Nov 08, 2023 at 03:55:53PM -0500, Brian Peters wrote:
> > What about NVID? NVID-2023-0001
> > Not (A) Vulnerability ID
>
> Now that reads like pun on NIST's NVD.
>
> We can come up with lots of other suggested names (and I had made some
> suggestions too), but I think we don't need to continue much further.
>
> So let's wind this thread down unless there's something truly new and
> on-topic to add.  I'll start rejecting messages if I have to.
>
> Alexander