Re: !CVE: A new platform to track security issues not acknowledged by vendors

["Mike O'Connor" <mjo () dojo mi org>]

!CVE Team,

> From an open source perspective, the CNA(s) who might be assigning
CVEs might not be a "vendor".  As just one example, the GitHub CNA
assigns tons of CVEs for open source software using GitHub's Security
Advisories, but I wouldn't think of GitHub as a "vendor" for all the
projects they host.  How do you deal with CNAs who might be fine with
assigning a CVE, but tagging it as DISPUTED?  Perhaps they don't want
to build deprecated decades-old code to scope out the severity of a
buffer overflow some random fuzzbot found.  How would !CVE work for
the Linux kernel, where most security fixes have git commit hashes but
not CVEs?  You don't seem resourced for that.

Overall, it seems like the prbolem you're trying to solve is "I'm not
getting my unique tag from CVEs CNAs for my vulnerability".  Your fix
is "some other unique tag mechanism for vulnerabilities".  I think I
see where this might be going:

https://xkcd.com/927/

Have you considered, I dunno, working with the CVE folks, addressing
what CNA rules you think may be broken?  Not all vulnerabilties are
created equal, and it may make sense to create more alternate systems
to deal with that.  But, forking off on your own should be done with
some due diligence.  The last thing the security community needsi are
even more fractured efforts, as they deal with enough fractured stuff.


My $0.02, FWIW...
-Mike

-- 
 Michael J. O'Connor                                          mjo () dojo mi org
 =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"But we decide which is right...  and which is an illusion."     -Moody Blues