3 ms·
Distributed Weakness Filing – CVEs for OSS Shuts Down
- philips 8y agoThread for the person leading the project: https://twitter.com/kurtseifried/status/1103858442479910913 https://twitter.com/kurtseifried/status/1103858442479910913 I couldn't even get most people to submit well formed CVE requests, let alone correct the badly formed ones, let alone actually help with CVE assignments. The market has spoken, nobody really cares about ensuring Open Source is broadly covered by CVE. 1/2 A few projects and vendors care about making sure what they ship or specifically research is covered (e.g. https://cve.mitre.org/cve/request_id.html#cna_participants https://cve.mitre.org/cve/request_id.html#cna_participants …) but nobody cares about Open Source in general, e.g. npm? 11 million developers. 73 CVEs...