- https://vulnerability.circl.lu/ - https://osv.dev/ - https://vuldb.com/

And a few others?

The circl.lu might be actually a potential cooperation partner.

(Vuldb is down right now)

They already did it. Great!

Maybe we can ask them how to contribute to their software, as it seems to be proprietary at the moment?

edit: lol, their manifest.json is still the React boilerplate: https://euvd.enisa.europa.eu/manifest.json

Their database seems to also only contain fairly recent CVEs (up until 2019? some CVEs are missing...) and not before that

  "Fourth, national vulnerability databases like China’s and Russia’s, among others, will largely dry up (Russia more than China)."

  "Fourth [sic], hundreds, if not thousands, of National / Regional CERTs around the world, no longer have that source of free vulnerability intelligence."

  "Fifth [sic], every company in the world that relied on CVE/NVD for vulnerability intelligence is going to experience swift and sharp pains to their vulnerability management program."

The CVE program is really important. This Administration is truly the example of the D.O.G.E. - Department Of Gaffes and Errors

Off topic: your username is very appropriate given the situation.

Indeed. Just as Germany knew their economy is vulnerable to Russian gas and did nothing about it, even after the 2014 invasion of Crimea. Just as the west knew moving their entire manufacturing sector to one country would make them vulnerable, but choose to ignore it because it was too profitable.

I never EVER saw politicians act proactively for the good of the nation or the people, all they do is act reactively after the shit hits the fan to control public opinion and blame someone else to make sure they get re-elected, that's it.

Once you realize our rulers aren't competent at their jobs or acting in the peoples' best interest, it all makes sense. They're in it for the grift and to enrich their monopolistic friends in the private sector, to make sure line goes up in the next quarter, that's it.

Yes, I know there are good politicians out there who care and fight for their local communities, but they never make it to rule at national or international stage and actually change the rotten system because the status quo doesn't allow that.

  - You're Germany.
  - You join NATO for protection from Russia, an actor with a long history of military aggression[1]
  - Your export economy is based on manufacturing.
  - The energy driving your manufacturing sector is ~60% cheap gas from Russia, your military aggressive partner.
  - Russia invades Georgia in 2008 and Ukraine in 2014 to no ones surprise
  - Leaders of USA and Eastern Europe warn you of Russia's influence on your economy
  - You ignore all this and build another gas pipeline from Russia
  - You are surprised Russia invades Ukraine(again) and gas sanctions cripple your manufacturing economy

Someone please stop the planet, I wish to get off, my sanity can't handle this level of stupidity anymore.

[1] https://natoassociation.ca/a-timeline-of-russian-aggression/

News from an American here, on an antidepressant and deathly fat from stress eating:

I’m worried about the eventual welfare of those protesting. I’m hearing that people of color are being told by their pastor to stay home rather than protest so as not to risk being used as scapegoats.

My family and friends are divided and still dividing over politics. I recently was crazily ranted to by big-personality entrepreneur immigrant that told me his story of how easy it was to come to the states, rags-to-riches, and how they were supporter of the administration because “they don’t want to pay taxes for illegals”. Part of the half of the U.S. that supports the administration isn’t just brainwashed, but has a very strong, angry, and desperate look, and the other part says “just wait four years and it will be over”, but it won’t; before the election, this party used gerrymandering and legal action to ensure that election, then post-election replaced election officials and many government officials.

The DOE is claiming anti-semitism and the need to have viewpoint diversity to deny funding to schools that are known for their open viewpoints.

And yet somehow I’m still surprised when they kill the CVE program.

It’s an ever-escalating circus of chaos, because our administration thinks this was needed to ensure U.S. interests, because those vulnerable in the U.S. were manipulated by outside actors and internal power-hungry politicians and zealots, and all is spun to just feed into the chaotic nationalism that is trying to one-up every other dictator that has ever lived.

To top all of this off, AI, which I use daily, will take my job before I retire, and I have no backup plan.

Despite all of this, I have the will to live, to support those whom I love (even the crazy ones), and to try to make the world better. I continue to pray for direction on all of this.

"German journalist dubbed the ‘Putin connoisseur’ had secret book deal with Russian oligarch" - https://www.icij.org/investigations/cyprus-confidential/germ...

"Russia's best friends in Germany: AfD and BSW" - https://www.dw.com/en/russias-best-friends-in-germany-afd-an...

"12 Germans who got played by Putin" - https://www.politico.eu/article/blame-germany-russia-policy/

https://www.aljazeera.com/economy/2022/9/2/russias-gazprom-k...

So they just swapped dependencies. And it's not that the new dependency will have no strings attached.

Diversifying while keeping russian energy in the loop, as part of a risk-management strategy, would make more sense. Completely cutting off russian energy just gives more bargaining power to their new energy provider.

Greed got us here. There's a rules based world possible where Russia sells gas to Germany. Russia did not transform from an free and democratic society with respect for human rights and the international community into an authoritarian dictatorship overnight; we turned a blind eye to this when it suited our short term economic needs and that is how we allow ourselves to sleepwalk into the situation we are now. Had we held first to our principles we'd have either had the impact the neoliberal trade focused policies were supposed to eventually deliver or at the very least not ended up with dependencies that gave such governments leverage and eventually blow up in our faces. Had we instead put human rights first and foremost we would not have created and empowered these monsters.

Same thing with Trump's reelection in the US. By all rights in a functioning democracy Trump should be sitting in jail right now along with the January 6th insurrectionists. The Biden administration had 4 years to prosecute, but felt it was not politically expedient to do so. Likewise what is left of the GOP within the republican caucus right now faces a similar choice between short term benefits and upholding the principles which nearly everyone in congress and even the Trump administration has previously claimed they would uphold.

*our alleged principles

Something can't be called a "principle" when it is only selectively applied.

You conveniently leave out that minor detail that it was RUSSIA who stopped the gas.

Germany tried hard to keep it going, even making a sanction-exemption or a Siemens turbine repaired in Canada, which according to Russia was needed. Only that when they were to receive it nothing happened, gas stopped anyway.

There is still Nordstream 2 Pipeline B intact available to deliver gas and it uses Russian made turbines compared to Nordstream 1.

The whole discussion is very special to say the least if you leave out that some adversary blow up the infrastructure.

"Moskau blockiert offenbar Weitertransport von Nord-Stream-1-Turbine" ("Moscow apparently blocks further transport of Nord Stream 1 turbine") -- https://www.rnd.de/politik/russland-blockiert-offenbar-weite...

I'm German, I followed those developments closely at the time. Russia refused to deliver gas! The blowing up of the pipes happened quite some time after that!

You also don't mention that German Gasprom, which controlled German gas reserves, emptied them just before the war! -- https://www.faz.net/aktuell/wirtschaft/gas-speicher-in-deuts... (German, paywall), -- https://www.zeit.de/news/2022-01/21/ungewoehnlich-leere-gass...

That shows that Russia prepared for using gas as an economic weapon against Germany especially well before they even started the war.

From the Zeit article:

German

> "Die Gasflüsse über die deutschen Grenzen sind unüblich niedrig für diese Jahreszeit - mit Ausnahme von Nord Stream 1, die sind konstant hoch", sagt Fabian Huneke. Es sei verwunderlich, dass vor dem Hintergrund der hohen Preise und der hohen Nachfrage die Gaslieferkapazitäten Richtung Europa so wenig genutzt würden. "Wenn Gazprom sich marktrational verhalten würde, würden sie die Gaslieferungen nach Europa auch durch die Pipelines, die durch Belarus und die Ukraine führen, verstärken." Den Grund für dieses Verhalten sieht der Energiemarktexperte in der Ukraine-Krise.

English, translated by Google

> "The gas flows across the German borders are unusually low for this time of year - with the exception of Nord Stream 1, which are consistently high," says Fabian Huneke. It is surprising that, given the high prices and high demand, the gas delivery capacities to Europe are so little used. "If Gazprom behaved in a market-rational manner, they would also increase gas supplies to Europe through the pipelines that run through Belarus and Ukraine." The energy market expert sees the reason for this behavior in the Ukraine crisis.

The unusual low gas storage reserves at the beginning of the year 2022 in Germany with 45% compared to usual 75% while Nordstream 1 is delivering at full capacity could be related to the sanctions which lead Poland to stop transit through the Jamal pipeline and other transit routes through Ukraine and possibly gas market trade activities. Having just the ‘economic weapon’ argument is lacking, especially in regard that Russian gas is still to today reaching Germany and it is in the interest of Russia to deliver.

Tangentially... how did the German name of the city/region get into _that_ form? Is it a loan from English?? Germany and Russia have been closely entwined for centuries.

Wikipedia has a comment which appears to make no sense:

> The [old] form Moskovĭ has left traces in other languages, including English: Moscow; German: Moskau; French: Moscou; Portuguese: Moscou, Moscovo; and Spanish: Moscú.

(There is an English term Muscovy for the region, but wiktionary suggests that it derives from the formal name given to the region in international Latin rather than deriving from Russian. In that case, a /w/ would also generate a letter V, so there's no explanatory power.)

Apparently, when different languages started to make the distinction, they picked a different letter combination: ov, ou, ow, au, ú, etc. probably depending on the local way of pronouncing the word.

Same for latin ivvenis, modernized to juvenis, which gave young, jeune, jung, joven, etc.

We're talking about a period many centuries after Latin phonology might have been relevant. The word doesn't come from Latin. Old English has no confusion between [v] and [w] to begin with; [w] is part of the phoneme /w/ and [v] is part of the phoneme /f/. In Middle English there's a distinction between /f/ and /v/, where we see French-derived words like village and vine distinguished from English-derived words like fill and fire, and from French-derived words like fine.

So what happened?

> Same for latin ivvenis, modernized to juvenis, which gave young, jeune, jung, joven, etc.

Please don't just invent things that sound good to you. Young and (German, I assume) jung don't come from Latin either.

> U, v and w are all derived from the same letter v, for which no distinction existed in latin (same for i, j and y).

Again, please don't just make up random non-facts. Latin has no letter J. It does recognize Y, as the Greek letter upsilon, which it distinguishes from all Latin vowels. The fact that Romance languages name "Y" the "Greek I" should have been a hint of this. You can hardly read any Latin that mentions Greeks without running into it; compare Pyramus, Thucydides.

This is almost certainly because those cases don't make the news.

Politicians react to the public when it stands up. Otherwise it will follow other agenda's.

That is why it is critical to have an informed public. When journalism has to compete with corporate owned Fake News and Entertainment, journalism dies, and democracy will follow. Then, add the spy business of Big Tech in the mix, with algorithmic silo's. The people don't even realize they are locked up in a jar, where they live on a diet of cultural engineering.

Now, pause a moment and think about what happens when you add AI-models to the mix. Your daughter, your neighbor will be totally brain-wrecked.

Which journalism are you referring to? The one owned by Rupert Murdoch? The Washington Post owned by Jeff Bezos? MSNBC? CNN? Are they better just because they're owned by different billionaires and interest groups?

I got news for you, the journalism you knew died a long time ago.

  - No real journalism, instead, career in media house depend on commercial ownership. Narratives tailored to segment, but no deep and critical analysis. 

    - "Let us talk about the tariffs today, they make zero economic sense" 
    - "I think what he meant is..." 
    - "Of course this is not entirely correct, but..." 
    - "President Trump has said.."
    - "Rubio did a press conference today"

    - Only drama, never the Big Picture.

    - Elections? According to the press, those are just
       - The latest polls!
       - Repeat marketing from spin doctors at affiliated media houses
       - "Debate" = Reality TV, scores are given on wit and emotional play

PP is looking for a pattern, finding, and abstaining from questioning or contextualizing it:

Engaging only with the first or most obvious layer of an issue—never going deeper into context, nuance, or systemic causes.

The quickest counterexample that comes to mind is Elizabeth Warren's Consumer Financial Protection Bureau. It has returned billions to American citizens.

If your first reaction is putting people into political/ideological camps in order to make their arguments weaker and easier to attack form a holier than though political/ideological angle, it's game over for me as I like to judge actions objectively based on the outcomes, not conservative vs democrat, left vs right, etc. since corruption and incompetence is colorblind.

I don't care which side of the political isle did what, I'm pointing at the systemic failures of the entire system built like a house of cards by all political parties, which collapsed as no thought was put into building it, and only chased short term profits at the expense of long term security. Trying to finger point a single political side only detracts from the issue which is the classic "divide and conquer" tactic politicians have been using to deflect blame and get away with it.

If government is allowed to operate without regulation, it corrodes.

The pattern is clear. Unchecked power imbalances are bad for everyone, but the folks at the top of a power imbalance generally advocate for it, and change the environment to ensure their power and reduce everyone else.

The problem is, if you try to check people's immaturity and call it out, you get labeled a bigot, a fascist, or a $fobe.

So people's immaturity is a consequence of the modern toxic positivity and cancel culture the west has bred where you aren't allowed to say anything that might hurt someone's feelings, so people grow up in a bubble of fakeness that's detached from real world issues.

You're pointing out the end effect but not the cause that has led to that.

The goal is not to call people out, the goal is recognition as a real, active issue at the root of a lot of public figure behavior. Those behaviors need to be called out, and those public figures shamed for their immature behaviors and immature opinions - which non-public figures then mimic in ordinary life. Which is an immaturity that I do not expect to be called out, which sound like you're focusing.

Beneath the immature world view and attitude is self deception, a far harder issue to call out. That self deception is caused by religious claims of answers to unanswerable questions. To accept an unanswerable question's "answer" from another is a self deception, driven by anxiety and fear. Life has uncomfortable unanswerable questions, and facing those unanswerable questions is a critical part of becoming mature - there are no answers to these questions about what happens or if there is an afterlife. By supplying answers to these critically unanswerable questions, religions create immature individuals that are in fact trapped within the cult of that religion's reasoning, which tends to be terribly immature in far too many logical manners. Then you get morons.

Adults don't just spawn into the world like characters in a video game. They're raised and educated into adulthood by the previous generation parents and political regimes. So if you want to point the finger for the issue with current generation, point it at those who raised and cared for them, as it was their job.

>and if that recognition takes place then society will generally recognize the issue, and that becomes internalized as an issue people understand.

The issue with your logic is that you assume society can recognize issues and acts rational to issues, when in fact it does not.

Society selectively chooses what it recognizes as issues, based on emotional manipulation and tribal behavior.

What could go wrong? I'm sure they'll vote rationally and responsibly and not in a vindictive way to watch the system burn to the ground. /s

“A society grows great when old men plant trees in whose shade they shall never sit.” — Greek Proverb

What our society did instead was cut down the tree to save money on upkeep and increase the value of their property. Sorry, but you reap what you sow.

https://euvd.enisa.europa.eu/

Appeared on the front page, with © 2005-2024 by the European Union Agency for Cybersecurity.

This is just an example of US cultural defaultism.

I cannot believe I am typing that second sentence, but here we are.

According to which rule would "owning by the EU" result in an option to immigrate? Immigration is handled on a per country basis. I don't see how the EU provide such an option.

The EU has agreed upon programs in order to bring in, through an immigration policy, high skilled persons from non-member states. More importantly, working within the member nations, as to which member nation would want MITRE to be located within their borders, is not something that is a hard sell given that it has economic advantages for whichever state(s) onboard MITRE.

Where in this is the option that the EU provides an option to immigrate because the EU owns something?

I'm very well aware of knowledge workers. It's not something the EU can provide as an option. What you linked to is the legal framework around how EU members can provide such a thing.

Agree. It'll likely happen that way. Still, dislike the initial incorrect assertion.

What cross-industry organisations exist that could coordinate?

>The POTUS transferred our cyber defenses to the EU

Ouch

So instead I will allow myself to be robbed and we'll all share the cost of a low-key restuarant. Or maybe let's charge each other to eat together, yeah!

On the contrary, I would argue that they deeply care about the environment. The REAL point of all those tit-for-tat tariffs with China including with small mail/packages are to drastically cut cargo/shipping emissions. The threatening of annexation of Canada? That was really to get ~70% reduction in air passenger traffic BECAUSE they care about the environment. Same with creating a few high profile border horror story incidents against nationals from allied countries. The real point of it? Reduce transoceanic air passenger loads and save the environment. /s

https://www.enisa.europa.eu/topics/vulnerability-disclosure

They have a tender going on tracking best practices: https://www.enisa.europa.eu/procurement/vulnerability-disclo...

So they will take 12 months to select for the tender...18 months pondering on the report...and in 3 years they make a tender out for a solution...

looking at average speed of bureaucracy in EU it will take roughly a year to set date for a meeting that will set the date for actual meeting which will decide if this will go forward or not....

(if you think i'm joking - i'm basing this on proposed EU initiative for nuclear power which started with setting a date of meeting to setup a meeting to draft an agenda)

It's actually been upgraded to the Sovereign Tech Agency now

I'm also visiting the local CCC chapters here this week, maybe it makes sense to have a separate e.V. where the CCC chapters are beneficiaries?

This might be the optimum time to implement CSAF and to lead by example when it comes to vulnerability disclosures.

The reason for the higher price is that both data and running software is redundant and decentralized by design - no need to configure anything.

That phrase does not address where and how to host data and run software, and while I think an e.V. would be a great idea, it also does doesn't address it. So these concerns seem orthogonal to my input.

The IC Protocol is indeed about redundancy and resilience, but also about sovereignty and security, and it does not just host data (like torrents) but also runs software in a verifiable way (in particular, for every message you get from a dapp on the ICP, you get a certificate that proves that the majority of nodes in the subnet agree on the result).

In a nutshell, it's a platform that gives you many guarantees (security, redundancy, sovereignty) out of the box - as opposed to classical solutions which have to be composed of many different building blocks that need to be orchestrated to work together.

There is no need for this though, by it's very nature CVE services are "authorities", that distribute fairly simple data. Also if it costs 500$ to keep it online it's not really giving you much more resilience than regular multi-node hosting and significantly less than torrenting which is effectively free for many volunteers.

There’s nothing wrong with normal GPL.

This project must be sustainable to survive, and honestly I don't care if AGPL doesn't work for your financial incentives. Then your incentives are the problem, not me providing it for free. If you cannot see the amount of maintenance a project like this requires, then I'd respond with: Take it or leave it.

Canada may be another friendly option

Let’s not site global critical infrastructure within 150km of US land borders for a generation, please.

As a Canadian, I can confirm it's nothing like what's happening in Ukraine.