News for hackers. Stuff that matters.
Re:CVE program faces swift end after DHS fails to renew cont... by Rebelgecko on Tuesday April 15, 2025 @09:10PM (#43700301)
I'm trying to steelman but I really can't think of a non- nefarious justification for this
Re:CVE program faces swift end after DHS fails to renew cont... by rqtwteye on Tuesday April 15, 2025 @10:31PM (#43700800)
I think it’s ignorance and arrogance. The US seems to be on a path to lose technological and science leadership. The current leadership doesn’t seem to understand things that aren’t flashy. I wonder when they’ll dial back on food safety. I am sure RFK knows some vitamins that protect against salmonella
Re:CVE program faces swift end after DHS fails to renew cont... by johnnyjeans on Tuesday April 15, 2025 @10:38PM (#43700846)
important to note: the US's food safety is already really bad. salmonella isn't a thing you have to worry about in first world countries. can't wait to see what plague demon spawns out of a food industry running amok after the FDA gets gutted.
Re:CVE program faces swift end after DHS fails to renew cont... by buzer on Wednesday April 16, 2025 @12:03AM (#43701312)
Salmonella and it causes are very regional in EU. Places like Finland have basically 0 cases of salmonella caused by domestic poultry products per year. If there salmonella is found from any chicken in the flock, the whole flock will be quarantined and generally fully slaughtered (meat & eggs must be pasteurized after the slaughter if they are sold). In 2023 0.1% of the tested flocks had salmonella.

According to https://pmc.ncbi.nlm.nih.gov/articles/PMC11945640/ most of the outbreaks in humans (where exact cause was found) were caused by foreign vegetables.

On other hand countries like Italy find positive samples from 27% of their flocks ( https://efsa.onlinelibrary.wiley.com/doi/epdf/10.2903/j.efsa... ). USA doesn't do testing at that level as far I understand, I only found that 8% of the tested chicken parts have salmonella (https://www.propublica.org/article/salmonella-chicken-usda-f...).

Re:CVE program faces swift end after DHS fails to renew cont... by ac29 on Tuesday April 15, 2025 @11:12PM (#43701044)
> important to note: the US's food safety is already really bad. salmonella isn't a thing you have to worry about in first world countries.

There were 65,000 cases of salmonellosis in the EU in the most recent data I could find (2022). Thats a lower per capita rate than the US, but definitely not zero.

Re:CVE program faces swift end after DHS fails to renew cont... by rickard on Tuesday April 15, 2025 @11:42PM (#43701215)
I agree that it’s not zero, but according to CDC, the US sees about 1.35 million cases per year in a population of about 346 million, which is about 390 cases per 100,000 people. Your figure for the EU over a population of 447 million in 2022 gives 14.5 cases per 100,000 people, or more than a factor of 26 less.

Being 26 times less worried about something translates, at least for most things, for me, to not being worried about it any more.

Re:CVE program faces swift end after DHS fails to renew cont... by WrongAssumption on Tuesday April 15, 2025 @11:21PM (#43701106)
Re:CVE program faces swift end after DHS fails to renew cont... by jjmarr on Tuesday April 15, 2025 @11:54PM (#43701270)
Re:CVE program faces swift end after DHS fails to renew cont... by WrongAssumption on Wednesday April 16, 2025 @04:17AM (#43702855)
From the the very article you linked

"The vast majority of chicken processed in the United States is not chilled in chlorine and hasn't been for quite a few years," says Dianna Bourassa, an applied poultry microbiologist at Auburn University, "So that's not the issue."

Re:CVE program faces swift end after DHS fails to renew cont... by senectus1 on Tuesday April 15, 2025 @11:12PM (#43701046)
the guy is ultimate small gov. he wants to rip it out by the roots.
Re:CVE program faces swift end after DHS fails to renew cont... by dmix on Tuesday April 15, 2025 @11:48PM (#43701242)
I don't think he's considered a small gov conservative. He increased spending last time and has continued so far this term. His tariffs are one of the biggest expansions in gov interference in modern history. They are also attempting to significantly expand executive power beyond even 9/11 terrorism days.
Re:CVE program faces swift end after DHS fails to renew cont... by 01HNNWZ0MV43FF on Wednesday April 16, 2025 @12:04AM (#43701319)
Small enough to fit in a uterus, big enough to kidnap and shoot citizens
Re:CVE program faces swift end after DHS fails to renew cont... by Sohcahtoa82 on Wednesday April 16, 2025 @03:23PM (#43709325)
If you truly believe this, you don't know what small government means.
Re:CVE program faces swift end after DHS fails to renew cont... by parrellel on Wednesday April 16, 2025 @09:58AM (#43705637)
According to the radio this morning, they're currently working to close all the FDA branches that do food safety testing, so, good guess?
Re:CVE program faces swift end after DHS fails to renew cont... by WesternWind on Tuesday April 15, 2025 @10:45PM (#43700886)
It's incredibly foolish. Whatever the justification is, it doesn't matter as much as the horrible outcome.

This is one of those things the government does for the benefit of the whole.

Re:CVE program faces swift end after DHS fails to renew cont... by esafak on Tuesday April 15, 2025 @09:58PM (#43700610)
Privatize all teh things?
Re:CVE program faces swift end after DHS fails to renew cont... by transpute on Tuesday April 15, 2025 @10:45PM (#43700884)
April 2024 article on the result of NVD funding cutbacks, with comments by Linux Foundation OpenSSF, security startups like ChainGuard and commercial vendors, https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...

  Threat intelligence firm Flashpoint noted in March 2024 it was aware of 100,000 vulnerabilities with no CVE number and consequently no inclusion in NVD. More worryingly, it said that 330 of these vulnerabilities (with no CVE number) had been exploited in the wild.. Since the start of 2024 there have been a total of 6,171 total CVE IDs with only 3,625 being enriched by NVD. That leaves a gap of 2,546 (42%!) IDs.
Despite all those private companies and various OSS projects being willing to contribute ideas, infrastructure and code, they have somehow failed to coalesce into a decentralized replacement for NVD, built on CC0 data and OSS tooling.
Re:CVE program faces swift end after DHS fails to renew cont... by cma on Tuesday April 15, 2025 @11:51PM (#43701256)
I tried to look over the history and I only see a funding increase, CISA cut $3.7 million at the end of 2023 for the next year and in response NIST reallocated extra funding to NVD: $8.5 million in 2024

A funding shortfall and strain isn't a funding cut. And from what I see there was a funding increase.

Re:CVE program faces swift end after DHS fails to renew cont... by transpute on Tuesday April 15, 2025 @11:55PM (#43701275)
Would appreciate a pointer to the source, thank you.

2025 article claims 30% increase in 2024 workload, https://www.securityweek.com/mitre-signals-potential-cve-pro...

> According to NIST, while the National Vulnerability Database (NVD) is processing incoming CVEs at the same rate as before the slowdown in spring and early summer 2024, a 32 percent jump in submissions last year means that the backlog continues to grow.

Re:CVE program faces swift end after DHS fails to renew cont... by cma on Wednesday April 16, 2025 @12:39AM (#43701532)
Can search these for the links

2023

> CISA had previously been supporting the NIST NVD program with approximately $3.7 million per year in interagency funding, which they have discontinued

2024

> While NIST has since reallocated $8.5 million to NVD for fiscal years 2024 and 2025

Assuming that's spread over both years it wasn't as big of an increase as I said, but is still an increase even inflation adjusted.

> 2025 article claims 30% increase in 2024 workload

Underfunding in the face of more workload isn't itself a funding cut.

Re:CVE program faces swift end after DHS fails to renew cont... by transpute on Wednesday April 16, 2025 @01:38AM (#43701854)
Thanks for the pointer. Is this a lobbying org? https://www.fdd.org/analysis/policy_briefs/2025/03/21/delaye...

> While NIST has since reallocated $8.5 million to NVD for fiscal years 2024 and 2025, this funding remains a fraction of the $300 million to $400 million estimated to be needed annually to fully restore capacity, with an additional $120 million to $150 million required to prevent further system “deterioration.”

Did NVD receive 300MM annual funding pre-2024? That would be a 98% funding cut.

Re:CVE program faces swift end after DHS fails to renew cont... by formerly_proven on Wednesday April 16, 2025 @03:03AM (#43702347)
300 million would’ve been a quarter of the NIST budget. Doubt.
Re:CVE program faces swift end after DHS fails to renew cont... by transpute on Wednesday April 16, 2025 @03:24AM (#43702484)
Yeah, bizarre site.

MITRE CVE/CWE budget is more transparent than NVD since it's a contract, listed on USAspending.gov.

Re:CVE program faces swift end after DHS fails to renew cont... by benfortuna on Tuesday April 15, 2025 @10:38PM (#43700845)
This neo-liberal approach has no place for soft diplomacy, which is what US hegemoney relies on.

This isn't just a rapid disassembly of economic structures, any trust and goodwill is completely obliterated as well.

Re:CVE program faces swift end after DHS fails to renew cont... by tart-lemonade on Tuesday April 15, 2025 @11:29PM (#43701158)
For decades, the US could be counted upon to fund things with little immediate benefit but massive long-term positive externalities. I don't think its likely that the republican party will "go back to normal" post-Trump, so we can all kiss the long-term reputation building that American hegemony relied upon goodbye. Short of a great depression-esque political reset, I do not see things changing for the better.
Re:CVE program faces swift end after DHS fails to renew cont... by ajross on Wednesday April 16, 2025 @12:01AM (#43701304)
Probably the thinking goes that someone in the international community will step in. CVE is in practice a global registry for all, thus "Why should the USA Department of Homeland Security pay for all the freeloaders".

Still shortsighted and stupid, but it's plausible this is intended as leverage to get someone else to pony up.

Re:CVE program faces swift end after DHS fails to renew cont... by alephnerd on Tuesday April 15, 2025 @10:41PM (#43700860)
> I really can't think of a non- nefarious justification for this

Tragedy of the commons - NVD and the CVE project havr been backlogged and facing funding issues for a couple years now, and most security vendors are either cagey about providing vulns in a timely manner (as it can reduce their own comparative advantage), or try upsell their own alternative risk prioritization scores.

Every company will gladly use NVD and CVE data, but no one wants to subsidize it and help a competitor, especially in an industry as competitive as cybersecurity.

Re:CVE program faces swift end after DHS fails to renew cont... by duxup on Tuesday April 15, 2025 @09:56PM (#43700601)
The process seems to be to dismantle anything not nailed down in government.

Now if you want that (even just funding) to be a thing ... you have to go through Trump & Co and pay your bribe to get it back up.

Re:CVE program faces swift end after DHS fails to renew cont... by giraffe_lady on Tuesday April 15, 2025 @10:19PM (#43700736)
> I'm trying to steelman

Why? This administration is not acting in good faith, you don't have to act as if they are. People and institutions doing that is part of how we got here in the first place.

Re:CVE program faces swift end after DHS fails to renew cont... by King-Aaron on Tuesday April 15, 2025 @10:44PM (#43700877)
I still find it wild that so many people are trying to frame these decisions through a political lens. This is the actions of a foreign bad actor dismantling critical institutions from within, not "bad policy".

Surely there's an antibody response.

Re:CVE program faces swift end after DHS fails to renew cont... by inejge on Wednesday April 16, 2025 @12:42AM (#43701547)
> I still find it wild that so many people are trying to frame these decisions through a political lens.

Why? The decisions are pretty well politically aligned with the ideology which detests the size and scope of the government (realistically, those aspects which the ideologues feel are not in their interest). What is unexpected is the swiftness and the brutality of action, but revolutions tend to be messy, and make no mistake, this is a revolution.

> This is the actions of a foreign bad actor

Now this sounds like a coping strategy: everything is so preposterous it couldn't possibly be homegrown. Foreign influence and underhanded actions are as old as human interactions, but IMO outright plants can't succeed without a massive economic and power asymmetry between the adversaries.

Re:CVE program faces swift end after DHS fails to renew cont... by King-Aaron on Wednesday April 16, 2025 @01:37AM (#43701847)
lol, coping strategy? I'm not American and have no reason to 'cope' with anything. There is enough evidence to make a strong allegation about Trump being a Russian asset.

The entire world seems to be able to 'cope' with that assessment.

Re:CVE program faces swift end after DHS fails to renew cont... by rat87 on Wednesday April 16, 2025 @02:33AM (#43702167)
They are not. Trump is no libertarian or small government guy. The build the wall guy is the opposite of that. Even with stuff like social security he usually at least rhetorically claimed to be for more benifits (as long as it goes to "real Americans") and he is all for increasing police and military spending. And generally spending more on stuff that gives him money. Plus giant tax increases (tarrifs). He doesn't care much if government is dismembered as long as it owns the libs and gets rid of the public corruption prosecutors/others who might stand up to him

Trump's actions towards Putin are highly irrational. Maybe he's being blackmailed, maybe he's being bought, maybe he just has likes Putins style but there is a reason people suspect him despite it being unlikely in the general case.

Re:CVE program faces swift end after DHS fails to renew cont... by King-Aaron on Wednesday April 16, 2025 @04:33AM (#43702961)
> He doesn't care much if government is dismembered

This is exactly the process that conservatives take to privatise services into their own friends pockets. Destroy services until they're ineffective and use it as an excuse to privatise it.

There's no such thing as small government, only large sprawling private services that the government hands money to.

Re:CVE program faces swift end after DHS fails to renew cont... by jfengel on Tuesday April 15, 2025 @10:23PM (#43700757)
Force of habit. We don't have a framework for talking under these circumstances, so we apply our outdated ones.

As you say, that's exactly what got us here. But the alternatives are very unclear, and seem deeply unpleasant.

Re:CVE program faces swift end after DHS fails to renew cont... by MiguelX413 on Wednesday April 16, 2025 @07:15AM (#43703923)
People should suck it up and not do it again.
Re:CVE program faces swift end after DHS fails to renew cont... by jfengel on Wednesday April 16, 2025 @09:33AM (#43705332)
The question is what they should do instead.

They could attack the non-steelmanned version, but that just opens them up to having their own comments attacked. You quickly get derailed. (It's sometimes called "sealioning".)

They could propose alternatives, but that too is subject to sealioning. Real alternatives are always subject to tradeoffs, and the answer to "how about you do X instead of attacking me?" is always "no".

They could refrain from discussing it, but that just allows the offenses to continue.

So what often happens is that people persist in acting as if this were a sincere discussion, and hope that a majority will recognize the quality of your argument. It's a lousy plan but I don't have much else to suggest.

Re:CVE program faces swift end after DHS fails to renew cont... by almostgotcaught on Tuesday April 15, 2025 @11:24PM (#43701124)
Imagine being eaten alive by a cackling hyena that ambushed you and all the while being like "hmm what is the appropriate steelman here? why do I deserve this? why is this just?"

In reality this would never happen so all these people playing steelman are just detached/insulated.

Re:CVE program faces swift end after DHS fails to renew cont... by petesergeant on Wednesday April 16, 2025 @12:49AM (#43701585)
>> I'm trying to steelman

> Why?

It's a sensible practice and good practice

Re:CVE program faces swift end after DHS fails to renew cont... by giraffe_lady on Wednesday April 16, 2025 @09:34AM (#43705346)
I just don't see how it is universally so, frankly. As a general guideline sure but some discernment is necessary nothing is gained from steelmanning apartheid or the third reich or torture prisons or or you see my point I hope.
Re:CVE program faces swift end after DHS fails to renew cont... by petesergeant on Wednesday April 16, 2025 @11:28AM (#43706675)
How can you argue effectively against something if you don't understand the strongest version of the argument _for_ it?
Re:CVE program faces swift end after DHS fails to renew cont... by giraffe_lady on Wednesday April 16, 2025 @11:56AM (#43706981)
We're way past the point of policy disagreements the relevant question right now is how do you stop them. It's certainly not by reimagining your adversary's actions in the most charitable light.
Re:CVE program faces swift end after DHS fails to renew cont... by mrguyorama on Wednesday April 16, 2025 @02:28PM (#43708761)
Exploiting the need to invent a "logical" reason to do something illogical is the exact attack vector that the Gish Gallop uses to fuck over people.

Like you get that right? This administration does not discuss or debate, it shits out lies and laughs as people play make believe high school debate games, and give them infinitely more effort than they did.

There is no such thing as "effectively arguing" against a Gish Gallop, that's it's entire purpose.

Re:CVE program faces swift end after DHS fails to renew cont... by emmelaich on Wednesday April 16, 2025 @01:07AM (#43701698)
It is the belief that it is not in good faith that makes it more important that you try to steelman it.

If the steelmanning fails then you can you can be even more confident that it is in bad faith.

Re:CVE program faces swift end after DHS fails to renew cont... by polski-g on Tuesday April 15, 2025 @10:40PM (#43700857)
We have a 2tn deficit. If Congress wants to fund this, they need to make it mandatory spending and raise taxes.
Re:CVE program faces swift end after DHS fails to renew cont... by viraptor on Tuesday April 15, 2025 @10:49PM (#43700916)
That's a good idea to raise during the budget time or with some warning ahead of time. But even discussing the cost of CVE program itself is likely a waste of time and money. When trying to deal with 2tn deficit, looking at things that historically got ~$5M is just a distraction. And the lack of it may cost even more given how many existing agreements/contracts rely on cve to be a thing - maybe just in gov lawyers having to rewrite things.
Re:CVE program faces swift end after DHS fails to renew cont... by rgreek42 on Tuesday April 15, 2025 @10:57PM (#43700956)
Selling bonds is not the same thing as a family budget being in the red. Either you know this and you're making this argument in bad faith, or you don't and, well...
Re:CVE program faces swift end after DHS fails to renew cont... by toomuchtodo on Tuesday April 15, 2025 @10:44PM (#43700875)
Or cut from $877B in defense spending instead?

https://usafacts.org/government-spending/

Re:CVE program faces swift end after DHS fails to renew cont... by xphos on Tuesday April 15, 2025 @11:19PM (#43701097)
Listen, I hate the debt, but we have an income problem, not a spending problem. The military looks like a waste, but it does more than build bombs i.e research etc.

The issue we have is that republican every chance they get since the 1970s have cut taxes. And then blamed democrats for causing the deficits. We don't need smaller governments. We need a reasonable tax system that taxes people. It can be progressive like it was before we decided rich people just need it easier than poor people.

Yes, I will pay more taxes sign me up, especially if they can finally fix the roads and fund research. The problem is my taxes as a middle-class person go up and rich people get a tax cut. It's stupid. I like water provided by government utilities, I like planes that don't crash into stuff because there are air traffic controllers. These things used to work because we paid for them. When you buy cheap you get cheap.

Re:CVE program faces swift end after DHS fails to renew cont... by matteotom on Tuesday April 15, 2025 @11:26PM (#43701142)
Yeah republicans claim to want to run the government like a business, but the first thing a business should do when they have a deficit is raise revenue! And especially in the case of the US government, the the only barriers to doing that are self-imposed.
Re:CVE program faces swift end after DHS fails to renew cont... by dboreham on Tuesday April 15, 2025 @11:25PM (#43701134)
Military also employs a bunch of people who otherwise would be poor. Also provides a gentrification path for a bunch of previously poor people extending throughout their lives.
Re:CVE program faces swift end after DHS fails to renew cont... by LPisGood on Wednesday April 16, 2025 @01:17AM (#43701744)
Yes, a big part of the size is because the military is a massive and horrendously inefficient jobs, education, housing, and healthcare program.
Re:CVE program faces swift end after DHS fails to renew cont... by throitallaway on Wednesday April 16, 2025 @01:25AM (#43701786)
Don't forget all the beak-wetting that happens along the way when signing contracts etc. That's where an actual difference could be made.
Re:CVE program faces swift end after DHS fails to renew cont... by mrguyorama on Wednesday April 16, 2025 @03:06PM (#43709157)
I think people VASTLY overestimate the amount of graft in military procurement.

Lockheed only has a $100b market cap. Raytheon has $200b. General Dynamics $74b

The reality is that US defense spending pays American designers and American laborers high prices for their American effort. We pay basically the same prices for ammo and supplies and services as other countries.

When we pay $13 billion for an aircraft carrier, that's just what it costs to build a gigantic boat with nuclear reactors. The French paid $4 billion for their aircraft carrier, and a $12 billion Gerald R. Ford class is over twice as large as the Charles de Gaulle (40k tons vs 100k tons), and much much much more advanced.

Americans love to misunderstand the cost of military things. They will scream about the F35's $1.5 trillion "price tag", ignoring that the estimate is for 50 years of operations and maintenance as well as initial purchase. Actual purchase price is about $90 million a plane, which is reasonable. Which makes sense, since being not stupidly overpriced was a key point of the program. The operational cost is about $40k a flight hour, which is roughly the same as the F-14, another high tech superplane program.

Re:CVE program faces swift end after DHS fails to renew cont... by LPisGood on Wednesday April 16, 2025 @04:53PM (#43710273)
40k per flight hour is actually extremely reasonable for an advanced aircraft - good luck trying to charter a large cabin private jet for cheaper.
Re:CVE program faces swift end after DHS fails to renew cont... by 01HNNWZ0MV43FF on Wednesday April 16, 2025 @12:07AM (#43701336)
Republicans control Congress, this is bait
Re:CVE program faces swift end after DHS fails to renew cont... by tootie on Tuesday April 15, 2025 @11:17PM (#43701083)
This is an absolute pittance compared to the total budget. And considering the current administration wants a $4T tax cut they are not interested in trimming the deficit at all.
Re:CVE program faces swift end after DHS fails to renew cont... by throitallaway on Wednesday April 16, 2025 @12:15AM (#43701389)
Yep, DOGE is a song and dance distraction. If they were serious about lowering the deficit they wouldn't have laid off ~12K IRS workers (whom show a 7x ROI per head.) They also wouldn't be asking to increase the military budget to $1 trillion per year. Trump has spent 1/3 of his days in office so far golfing; $30 million+ so far paid to Trump properties for the privilege of that. This is the biggest capture in US history and it's all out in the open.
Re:CVE program faces swift end after DHS fails to renew cont... by chris_wot on Tuesday April 15, 2025 @11:08PM (#43701022)
Dear god, you don't just stop running government completely because you have a deficit.
Re:CVE program faces swift end after DHS fails to renew cont... by sneak on Tuesday April 15, 2025 @09:19PM (#43700378)
We don’t need to spend tax dollars to increment sequential integers.

The “CVE program” can be done by a volunteer or two in spare time. It’s not some major operation, it’s just a registry of integers that can live on GitHub.

Re:CVE program faces swift end after DHS fails to renew cont... by _carbyau_ on Tuesday April 15, 2025 @10:38PM (#43700842)
Thanks for volunteering to manage the "300-600 CVEs each month"!

The world needs more volunteers like you.

Re:CVE program faces swift end after DHS fails to renew cont... by techky on Wednesday April 16, 2025 @12:07AM (#43701334)
Make that 3,000-4,000 on average per month, according to NISTs stats on CVEs for last year. ~40,000 for 2024.
Re:CVE program faces swift end after DHS fails to renew cont... by charcircuit on Tuesday April 15, 2025 @11:13PM (#43701062)
You manage the system and not the CVEs themselves. The simplist thing would be a list of numbers that correspond to Google docs. The owner of the Google doc can share it with the needed parties and eventually set it as public.
Re:CVE program faces swift end after DHS fails to renew cont... by goku12 on Wednesday April 16, 2025 @12:09AM (#43701358)
You truly believe that the CVE database (and others like CWE) are only about assigning serial numbers to random reports, don't you? I see people underestimating and understanding the work of others in matters like this. Is that a trend now?
Re:CVE program faces swift end after DHS fails to renew cont... by charcircuit on Wednesday April 16, 2025 @12:16AM (#43701399)
No I don't believe that, but it might as well operate like that. The extra stuff isn't truly needed and was being outsourced to the companies that own the products since it wasn't providing much value. Take a look at Daniel's blog posts about CVEs for curl for what happens when you let them handle it.
Re:CVE program faces swift end after DHS fails to renew cont... by worthless-trash on Wednesday April 16, 2025 @12:20AM (#43701425)
I saw this same behavior quite a while back. While I'm out of the CVE game these days, it seems that there is a forever rotating new group of people who simply don't and can never see the complexities on the process.

I think it's a testament to the previous stewardship that it appears so simple.

Re:CVE program faces swift end after DHS fails to renew cont... by JCharante on Wednesday April 16, 2025 @05:32AM (#43703324)
I imagine most of those CVEs not being anything meaningful and just script kiddies trying to put something on their portfolio

all the meaningful ones will show up on HN

Re:CVE program faces swift end after DHS fails to renew cont... by Rebelgecko on Tuesday April 15, 2025 @09:56PM (#43700596)
How do you get your volunteers in the first place and manage them so you know it's time to get a new one if the quality of their work is slipping?
Re:CVE program faces swift end after DHS fails to renew cont... by viraptor on Tuesday April 15, 2025 @09:49PM (#43700551)
Yet so far no volunteer has emerged and people who do run CNA are pretty busy with it.
Re:CVE program faces swift end after DHS fails to renew cont... by _zer0 on Tuesday April 15, 2025 @09:53PM (#43700577)
I think sneak would volunteer to do it since it is pretty simple according to them.
Re:CVE program faces swift end after DHS fails to renew cont... by mlinhares on Tuesday April 15, 2025 @10:15PM (#43700710)
Any work people don't understand must be easy and replaceable by chatgpt. Just look at how easy people here think farming is.
Re:CVE program faces swift end after DHS fails to renew cont... by johnnyjeans on Tuesday April 15, 2025 @10:47PM (#43700900)
Grok becoming an artificial nepobaby running the entire CVE program with zero oversight sounds so fucking funny I don't even care, PLEASE god make this real holy shit I can't breathe at the thought
Re:CVE program faces swift end after DHS fails to renew cont... by stevekemp on Wednesday April 16, 2025 @01:46AM (#43701900)
There were some, short-lived, projects/groups trying to run their own processes. DWF is one that I recall, though it is dead again:

https://lwn.net/Articles/851849/

Re:CVE program faces swift end after DHS fails to renew cont... by gessha on Tuesday April 15, 2025 @10:36PM (#43700831)
Found the blackhat
Re:CVE program faces swift end after DHS fails to renew cont... by skeledrew on Tuesday April 15, 2025 @10:17PM (#43700722)
Who needs volunteers? Let AI handle it!
Re:CVE program faces swift end after DHS fails to renew cont... by fnordpiglet on Tuesday April 15, 2025 @10:30PM (#43700793)
This is like saying the patent system is just an incrementing counter.
Re:CVE program faces swift end after DHS fails to renew cont... by sneak on Wednesday April 16, 2025 @02:43AM (#43702215)
Have you seen the patents they have been giving out lately?
Re:CVE program faces swift end after DHS fails to renew cont... by Cthulhu_ on Wednesday April 16, 2025 @03:09AM (#43702387)
Reduce government spending; since it's not actually a government organization (as far as I can tell, I never looked into it before), other organizations can fund it. How much goes into this organization a year anyway? I'm seeing a Mitre corporation that does lots of other stuff too that has a revenue of 2.2 billion a year.

Multi-trillion-dollar companies benefit from and contribute to this system, surely they can spare 0.01% of their revenue to this bit of critical infrastruture?

Re:CVE program faces swift end after DHS fails to renew cont... by bert-ye on Wednesday April 16, 2025 @03:40AM (#43702592)
> surely they can spare 0.01% of their revenue

They would, if we made companies pay their taxes.

Yes, you can also run such a system based on donations. But I personally think that such a system is important enough to be paid for by the government. When you run on donations, there will always be conflicts of interest and the risk of running out of funds.

But yeah, Mitre being a private organization that was paid for by the government was a problem.

Re:CVE program faces swift end after DHS fails to renew cont... by terribleperson on Wednesday April 16, 2025 @04:04AM (#43702757)
Yes, I'm sure corporations funding the CVE system would go wonderfully. "It would be best if we don't see any severe CVEs for our products this quarter, if you want our funding next quarter."
Re:CVE program faces swift end after DHS fails to renew cont... by kesor on Wednesday April 16, 2025 @05:40AM (#43703362)
MITRE is a non-profit, it receives about $1.5B from the federal government, and another almost $2B from Virginia.
Re:CVE program faces swift end after DHS fails to renew cont... by karel-3d on Wednesday April 16, 2025 @03:52AM (#43702662)
Reduce spending. Steelmanning (not actually believing this): it probably cost a lot for what is essentially a database, and can be done cheaply by private sector (Google, Microsoft).
Re:CVE program faces swift end after DHS fails to renew cont... by myko on Wednesday April 16, 2025 @06:49AM (#43703741)
It's a dying empire, really nothing else to say. The USA led world order is over, we've voted ourselves out of it, and now need to learn how to deal with that.
Re:CVE program faces swift end after DHS fails to renew cont... by drstewart on Wednesday April 16, 2025 @07:13AM (#43703908)
Wow! So who is leading the world order now (aka who is funding MITRE)?
Re:CVE program faces swift end after DHS fails to renew cont... by throw4847285 on Wednesday April 16, 2025 @10:33AM (#43706086)
I'll admit this is a bugbear of mine, but I think this is the reason "steelmanning" is counterproductive.

Steelmanning is a neologism that serves no purpose other than in-group signaling. There was already a perfectly acceptable term for the same concept, one with more nuance and a rich history: Charitability.

The major difference is that charitability is about treating your interlocutor with respect. Steelmanning is about using one's own intellect to make your interlocutor's argument better than them. Because charitability is based on a concept of mutual respect, if somebody clearly doesn't respect you one iota, then why would you be charitable? Steelmanning tries to divorce the person from the argument, and is ironically both arrogant and naive.