The scores were never going to be that accurate across people's environments (IDK how much other places relied on them, places I worked never did that much) and issues with the scores don't seem to be a good justification to torch the whole CVE system anyway.

This^ and to add to that, at the very least MITRE assigned IDs which is great. Plus they did an initial scoring, which, well… will never be perfect like you said and I’m sure these things evolve throughout time and get better (not talking necessarily CVSS vX).

What a shame on this current gov. administration, if you can even call it that.

Why isn't it a good justification?

I think the question everyone in this thread should ask is: why is it the government's job to do this, especially given the prior widespread view that they're doing a bad job? Is the software industry so immiserated by poverty that it cannot organize its own distribution of security bulletins? Clearly not: GitHub already runs its own vuln tracking scheme that's better integrated with the tooling we use for open source software. The industry routinely sets up collaborations like standards bodies, information sharing groups and more. And there is as whole ecosystem of security companies to help you understand vulns in your stack.

So there seems nothing specific to CVEs that requires government involvement, but the existence of the tax funded scheme does discourage the creation of competitors that might function better.

But, to CVE or not to CVE ... that is not the question. US deficit spending is out of control. This sort of thing had to happen some day. It's what Europeans in the 2010s called "austerity" and it always makes some people scream but this graph:

https://fiscaldata.treasury.gov/americas-finance-guide/natio...

... is not sustainable. Up to 1984 overall US debt was stable. Since then its growth rate became dangerous. Debt/GDP ratio is now worse than just after WW2. The federal government is currently spending more on interest than on defense or Medicare:

https://www.crfb.org/blogs/interest-costs-have-nearly-triple...

The US is currently getting its first taste of what parts of Europe started going through in 2008, and unfortunately there's bad news: the cuts you're seeing now are mostly cosmetic. They're what can be done within the current framework of laws, sort of, with lots of bending of the rules and creative interpretations of them and maybe some oversteps. But it's just the start of what's needed. Large scale reform of the laws themselves will be required regardless of whoever wins the next elections.

> why is it the government's job to do this?

Because the private sector can't see past their profit motive to the national defense motive.

> But, to CVE or not to CVE ... that is not the question. US deficit spending is out of control. This sort of thing had to happen some day.

I suppose more people would be more amenable to these wholesale cuts if the current administration weren't blowing through even more money than before [0]:

> The new Treasury Department data shows a deficit of $1.307 trillion for October through March, the first six months of the fiscal year 2025. And spending is $139 billion more in the first three months of 2025 compared to the same period last year, with borrowing over that period $41 billion higher.

We're currently fighting no wars and yet Trump is proposing a record $1 trillion defense budget [1]:

> “We’re going to be approving a budget, and I’m proud to say, actually, the biggest one we’ve ever done for the military,” he said. “$1 trillion. Nobody has seen anything like it.

And that's before proposed cuts to tax revenue [2]:

> Extending the expiring 2017 Tax Cuts and Jobs Act (TCJA) would decrease federal tax revenue by $4.5 trillion from 2025 through 2034. Long-run GDP would be 1.1 percent higher, offsetting $710 billion, or 16 percent, of the revenue losses.

So this whole "we're just imposing much needed austerity" to justify penny-wise-pound-foolish policies is kind of laughable when the proposed increase to our peacetime defense budget alone wipes out Elon's most recent estimate of DOGE's total savings [3].

[0] https://apnews.com/article/trump-biden-budget-deficit-spendi...

[1] https://www.militarytimes.com/news/pentagon-congress/2025/04...

[2] https://taxfoundation.org/research/all/federal/trump-tax-cut...

[3] https://www.nytimes.com/2025/04/14/us/politics/elon-musk-dog...

Yes. The Republicans are not and never have been united around fiscal conservatism. Eliminate-the-deficit libertarians are one faction within the party but not the dominant one, and Trump doesn't come from it. Same with most right wing parties the world over: the bigger faction is usually one that likes both tax cuts and spending increases. That's why deficits are out of control across the west: between the tax-and-spend left and the don't-tax-but-spend right, the don't-tax-and-don't-spend contingent isn't big enough to outvote the others. Clinton was very unusual in this regard, perhaps a product of the short post-USSR consensus.

Elon is a libertarian and has been allowed to go do some spending cuts around the edges. This gets support from Republican members of Congress partly because the USG turns out to be spending a lot of money on highly partisan Democrat projects, but mostly because it's someone else doing the cutting and not them. Even if they know they should be doing it themselves they don't want the crazies trashing their cars, so if some outsider does it for them that's a deal they'll happily take whilst it lasts.

All that said, it's inevitable that the administration would be blowing through more money than before even with DOGE. It's the nature of debt that it compounds. The level of cuts required to even keep the deficit stable would be huge because interest payments are accelerating, and the cuts DOGE are allowed to make are small (even when they go further than they might technically be allowed).

Right now there's just no mainstream support in US politics for serious austerity. There never is in any country, but sometimes the public can be convinced to agree to some amount if politicians do a good job of communicating the deficit problem. The UK in 2010 is an example of that, where the Conservative/Lib Dem alliance was able to convince the public to vote for spending cuts (albeit not as deep as were actually required... but it tided the UK over until the economy started growing again).

> why is it the government's job to do this

This is like, exactly the sort of thing that the public sector should be doing. There's no profit incentive for this to happen in the private sector.

I don't disagree with your overall sentiment re: unsustainable debt. But the answer must be reform and taking hard looks at the military budget, not just randomly cutting programs that you disagree with politically.

More like the Clinton approach.

But, why is there no profit incentive to do this when for-profit companies are already doing so?

https://github.com/advisories

Note that many of these entries start with GHSA not CVE.

Agree that the military budget should face large cuts too, unless I guess a major war breaks out.

They are doing it, but there's no profit incentive. Github is a bit of a special case because of their commitment to OSS and the broader engineering community, but the moment a downturn occurs and MS takes a harder look at P&Ls, you better believe that's on the chopping block.

The public sector is exactly where you need things that are important to society but don't make money.

There's a profit incentive: GitHub sells its services. The free stuff is an advert.

At any rate, even if they give it away for altruistic reasons, Microsoft is a sustainable going concern that brings in more than it spends. It can afford charity. The US government isn't and can't.

and then a random 9.8 critical comes that affects some software you have in a way that makes it a 0 in your environment but it doesn't matter cause the cve tanks your organizational Security Score (tm) by 10 arbitrary points and management is wondering when you'll secure the company again because the Security Score is their only tangible deliverable to measure success

Yeah like when we bundled in a .js library for client side date processing that has a CVE affecting node.js servers with high score. Our auditors don’t care they tag the whole app as high risk. It doesn’t even run on the server!

the auditors that sign off on your security to meet your clients requirements usually know way less about your security posture than your clients do

its all just surface-level box-checking. most companies required to get 'penetration tests' just get an overpriced Nessus scan sold as a pentest and that meets their reqs.

while this is true it in no way diminishes the value that orgs like cve provide

Incompetent auditors don't detract from the classification system, though. If we removed every data point auditors misinterpret or don't care to understand, we may as well remove all metrics.

Most tracking tools have exception processes. But yeah, security as a product family instead of a simple score seems to be a foreign concept at most companies.

I feel that. So tired of management being completely uninterested in actual, actionable security holes but getting wildly spun up because they saw a notice with a big scary number that has absolutely no relevance in our architecture.

Don’t let the perfect be the enemy of good. It is(was?) a very useful and important system.

Trump must be receiving a lot of emails from companies wanting to fill the void, and I bet the Trumpiest of them all is going to be awarded a contract worth 10x the budget CVE had, and do a much worse job.

It’s Way Better than what we had before: software vendors making even arbitrarier decisions about how to classify them.

There are far too many bad actors for us to operate as an industry with no yardstick.

I disagree that it is Way Better than before. A judgement call is worth more than a team wasting effort chasing irrelevant pseudo-vulnerabilities being reported as vulnerabilities. A broken yardstick is worse than no yardstick.

But that's an issue organizations bring upon themselves, by defining semi-arbitrary KPIs that are used without proper interpretation. It's not directly caused by CVEs or assigned scores. It's like blaming git that it count lines in diffs, because your company created a KPI that measures developer's based on LOC changes.

Fair point. I was not blaming CVE for the situation, simply bemoaning the situation.

Spot on. Vulnerability scanners that make up an organizational Security Score (TM) tend to operate at the wrong level of abstraction, flagging some library somewhere that never runs and has nothing to do with your production flow or architecture, or some test keys with zero security impact. Go explain that to management, because obviously the security tools are right and you are wrong. This sad state of affairs is unfortunately the best that the security industry has been able to deliver. Trying to wrangle complexity by adding more complexity is the craziest notion to me. Yes, no scoring scheme is perfect, but when the scheme introduces more noise, what have we gained (well, security vendors gain, but what have organizations gained).

This is my research field. Do you have any input you can think of at the top of your head?

That's very cool. You probably know more about it than I do, then, but my advice is to articulate the exact problem you try to solve.

I expect your field is probably teeming with AI proposals or offers on how to manage vulnerabilities, but that is doubtful the way, because again it is adding complexity, and no classifier is perfect, especially when scanners fail to understand scanned applications and their threat models or environment.

Stop selling external scanners, start simplifying code? This will never work, of course, because security vendors sell the promise of security to those willing to buy it, in the form of add-on products and capabilities.

Empower people to ignore scanner reports without so much red tape? That would never work either, because megacorp wants compliance and reduced liability.

Build secure systems as opposed to cataloging and scoring flaws? That would never work, because building secure systems is hard, nature tends to favor otherwise.

Charge people for adding complexity and credit them for removing complexity? Sadly, there is no way to do that, especially since products must ship and quality is hard to observe, since it is often invisible and only surfaces when things are broken.

Off the top of my head, would be nice to require proof of exploitation, by adding CTF-like capabilities to apps, such that only if the flag is captured do we consider the report real. This places more burden on scanners, in that it is no longer enough to report an outdated library. Requiring some proof of exploitability reduces noise and increases SNR, reducing false positives. Naturally, not all vulnerabilities have working exploits, and scanners can never fully simulate an adversary, so we may get more false negatives, but at least we would not have to waste so much time upgrading pointless modules and breaking applications to appease a false report. So the idea is "here is a dummy asset, show me how you leaked or compromised it". Adding the dummy asset should be cheap, but would force scanners to better simulate an attack.

At the very least, there ought to be a knob to decrease scanner sensitivity.

And it's not enough to explain it to management, you also need to explain it to your ISO auditors, your customers et cetera ad nauseam.

Solving this problem in a generalized way is really hard.

Maybe I have a dependency on Foo which has a critical vulnerability in a feature that I don't use. I suppress the warning and all is well. Then two weeks later someone on my team decides to use that feature, not knowing that there's a problem with it. Now we're fucked, and we'll never know because the vulnerability has been suppressed.

I don't know of anyone who doesn't quickly become exhausted after running a CVE scanner on their code.

This will get lost in the noise, but i think you mean cvss.

CVE is simply identification of a flaw, not a scoring system.

Sure. There's also major problems with the video encoding pipeline at my big tech job. Let's just delete it

> Weren't there major problems with the current CVE implementation

Absolutely. And if the headline was "DHS proposes improvements and streamlining to the CVE program" we'd all probably be cheering.

Leaping from "This is Flawed" to "Let's kill This" is a logical fallacy. A flawed security registry is clearly better than no security registry.

There are a lot of logical fallacies. Have you heard of the sunk-cost one? Or fallacy fallacy maybe? Or ten-tendril eschatomon fallacy?

In honesty to say "logical fallacy" is spoddy, I advise against for aesthetic reason.

These sound like downstream effects of funding stress to me, no?

This is bikeshedding. The point is an authoritative process and an identifier

All this does is help Putin and other rich grifters.

you like to say word 'bikeshedding', adoption of formal intellectualish sounding terminology even when inappropriate is orange-site affliction I advise against. I am saying this for your own sake... speak truths with POWER

It's a legitimate term. It's like criticizing use of the word startup or demanding someone put a dash in frontend or backend.

term is real... but is more like criticizing misuse of word startup. to be even more accurate it is what I said and not anything else

Maybe you don't see how it's bikeshedding. Ah well, let me try to explain.

It's because it's like if someone had forgotten to validate the user's role in an endpoint in a Django app, and someone said that they should have used Rails because it's easier to understand. In reality both are easy enough to understand to be able to do an authorization check, and the framework isn't the issue. So the person suggesting Rails is bikeshedding.

Likewise, if someone made another vulnerability database it would likely have the same issue, and this isn't really the place to solve it. If somehow this does trigger the realization to solve it, then it will be by luck.

We're getting into pedantic arguments, but bikeshedding is when multiple people argue to death about the easy stuff because it's easy, and don't argue at all about the actually hard stuff, because none of them know enough to argue about it. I don't know what your example is, but it's not bikeshedding.

I had argued for a less pedantic take, but I guess by replying to you I'm being pedantic. It seems to me that my example not only is bikeshedding by the definitions I find but also that to me it fits your definition of it. It's easier to talk about what framework you think is best than it is to talk meaningfully about process, which is more relevant place to look to prevent serious bugs, assuming both frameworks are capable. https://en.wiktionary.org/wiki/bikeshedding

Bikeshedding is when people need to make a decision on something, and keep talking and talking about the easy stuff. Your example of someone offering a driveby opinion isn't an instance of a group of people needing to make a decision.

Ah, it wasn't a driveby opinion how I imagined it, and I've experienced stuff like it in the past. It would then go into talking about rails features and libraries that could save the day, and the django counterparts. The decision that needed to be made would be what action to take to prevent a similar issue from occurring in the future.

I'm not saying it doesn't happen, but bikeshedding is when you say "OK guys we need to figure out the architecture of this complicated new service" and then there's a bunch of debate on libraries and frameworks and very little debate on the actual (hard) problem it needs to solve.

Thank you for the unsolicited defense. Linguistic bikeshedding is tantamount to an ad hominem. It's the mark of someone unable or unwilling to form a rational, valid argument or engage in civil discourse. Let's instead refocus to the HN site guidelines please. :o)

As an active consumer of CVEs: yea there are major problems. No there's nothing better and no I don't have any better ideas.

The scores are mostly useless, I would not care if they disappeared, I do not look at them. I don't really understand why people get so upset about garbage scores though. If a high CVSS score creates a bunch of work for you then your vuln mag process is broken IMO. (Or alternatively, you are in the business of compliance rather than security. If you don't like working in compliance, CVSS scores aren't the root cause of your misery).

Having a central list of "here's a bunch of things with stable IDs that you might or might not care about" is very valuable.

> you are in the business of compliance rather than security.

So, most businesses. They all need their ISO/NIST/HIPAA/etc certs.

Yeah, most businesses need window cleaners too. If you're a window cleaner and you complain about all the birds shitting on windows, I dunno what to tell ya.

If you're working in compliance either

A) you're stuck in your compliance job, that sucks, CVSS scores aren't the reason why though.

B) you enjoy compliance.

C) you should change jobs.

Often it is a second order impact. This creates a bunch of work for the compliance people, but then the compliance people end up competing a bunch of work for everyone else. If you count anyone who might have to follow compliance as working in compliance, then I purpose that there isn't enough non-compliance jobs to go around.

Hmm I dunnno I think

a) If you are having to do busywork for compliance reasons, you are either disempowered to push back on bullshit work (case A above, unfortunate, but your job was gonna suck anyway), or it's not really a second order effect, you work in compliance in a meaningful way.

b) Compliance bullshit seems to expand into the space available to it. Nobody thinks CVSS scores are meaningful, the fact that they feed into compliance processes is not the CVSS scores' fault it's the compliance machine just globbing onto random bullshit as its expansion continues. If you took away CVSS scores it feels like it would just glob onto something else instead.

Anyway, in the end I think we aren't disagreeing about that much. I think they're silly, if someone wanted to get rid of them I wouldn't try to defend them at all. I just wouldn'e be the person to push for that.

Getting a bit tired of posts like this (no offense), something dumb / nefarious happens like funding is cut for <useful thing>, then someone posts an off the cuff comment or question like, "wasn't this <useful thing> not that useful because <superficial reason>?".

Why do people do this, to down play all the destruction of the last few months? Seems to be some type of coping mechanism.

Every system has problems. The challenge is to address the problems and fix them. Not just delete the entire system and claim a win.

Yes it earnestly needed new direction and leadership.

Classic "oh its broken so throw it all away".

It's the way it is because there isn't a good alternative. They cannot possibly know every environment that we operate in.

To this day we still have large corporations down playing their issues, and it was way worse 20 years ago.