oss-sec mailing list archives
RE: MITRE is adding data intake to its CVE ID process
From: "Williams, Ken" <Ken.Williams () ca com>
Date: Fri, 10 Feb 2017 23:39:41 +0000
Tim, Your perception is incorrect. I can assure you there is no CVE-related bias whatsoever towards commercial software, or against OSS. Never has been any CVE-related bias against OSS, and I can't imagine there ever will be. I'm a big OSS fan and advocate, and although I will only speak for myself, I'd be willing to bet that everybody else involved with the CVE project is too. As far as sending copies of CVE web form submissions to oss-sec, or posting anywhere else, keep in mind that much of that info needs to be embargoed until a vendor security advisory is published. Regards, Ken Williams Disclaimer: I've been on the CVE Board for 17 years.
-----Original Message----- From: Tim [mailto:tim-security () sentinelchicken org] Sent: Friday, February 10, 2017 4:49 PM To: oss-security () lists openwall com Subject: Re: [oss-security] MITRE is adding data intake to its CVE ID processThis is a fine supplement to the oss-security list, but it completely removes the possibility of natural discussion of CVEs by members of the list. Valuable insights might never surface unless every list member manually monitors the database and decides to send a message regarding a given database entry. In short, it removes the best avenue toward the collaboration upon which all OSS development is based in the first place. I don't mind if MITRE requires submitters to use their web stuff, but messages generated by that tool should also appear on this list, or something very valuable will be lost.It's pretty clear that MITRE's interest is increasingly aligned with commercial software vendors and not the open source community at large. I wouldn't hold your breath on improvements to how The MITRE Corporation deals with our community. If you want something better, we'll have to build it ourselves. Note that I'm just the messenger. tim
Current thread:
- Re: MITRE is adding data intake to its CVE ID process, (continued)
- Re: MITRE is adding data intake to its CVE ID process Pierre Schweitzer (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Moritz Muehlenhoff (Feb 11)
- Re: MITRE is adding data intake to its CVE ID process Bob Friesenhahn (Feb 11)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Ben Tasker (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mike Gerwitz (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Seth Arnold (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Maier, Kurt H (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 10)
- RE: MITRE is adding data intake to its CVE ID process Williams, Ken (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Mats Wichmann (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Adam Caudill (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Tim (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Guido Berhoerster (Feb 10)
- Re: MITRE is adding data intake to its CVE ID process Solar Designer (Feb 11)
- Re: MITRE is adding data intake to its CVE ID process Kurt Seifried (Feb 12)
- Re: MITRE is adding data intake to its CVE ID process Ian Zimmerman (Feb 13)
- Re: MITRE is adding data intake to its CVE ID process Ian Zimmerman (Feb 13)