Re: Re: MITRE is adding data intake to its CVE ID process

[Kurt Seifried <kseifried () redhat com>]

so longer term (like starting now) the master database for DWF:

https://github.com/distributedweaknessfiling/DWF-Master-CVE-Database

will have a list of blocks (generally 1000) and the url they are at (git
link to clone), I want to shard the database otherwise a git repo with 100k
cve's being updated will get unwieldy, and this also makes life a bit
simpler for larger CNAs.

As for the old tyle CSV representation of the data we'll probably do that
as well since it is what people are used to consuming, but ideally we'll
get the DWF data being imported into MITRE and processed fast enough that
people can just consume MITRE's CSV feed (and resulting NVD feed and
whatnot).

So for now I'm focusing on some back end things like the CVE Mentor
process/CNA training, the JSON data format so MITRE can consume data and so
on.



On Mon, Feb 13, 2017 at 12:56 PM, Ian Zimmerman <itz () primate net> wrote:

> On 2017-02-12 11:23, Kurt Seifried wrote:
>
> > As for the DWF it's simple: we're using git, so I guess if people really
> > want up to the minute updates they can simply subscribe to the repos in
> > GitHub, or pull and do it on their own end.
>
> This?
>
> https://github.com/distributedweaknessfiling/DWF-Database
>
> Quoting:
>
>  IMPORTANT NOTE
>
>  There is a good chance this database (and indeed repo) will be phased
>  out in favor of the JSON database. If there is enough demand for it
>  there may be a CSV representation of all the data, but if there isn't
>  enough demand then we will simply drop it in 2017. So speak up if you
>  want/need this.
>
> Is there a separate place for the JSON data?  Where?
>
> --
> Please *no* private Cc: on mailing lists and newsgroups
> Personal signed mail: please _encrypt_ and sign
> Don't clear-text sign: http://cr.yp.to/smtp/8bitmime.html



-- 

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com