Yep, you know way more about this than I do. I've wanted to solve this problem for a while so any feedback helps. The only thing you seem to be missing in the

Yep, you know way more about this than I do. I've wanted to solve this problem for a while so any feedback helps. The only thing you seem to be missing in the above is the consumers. It's not about getting the vulnerabilities transmitted to them, it's about posting that they exist, who did them, how severe they are, and in a way that can be verified by all three parties. AFAIK, I can't currently go do that with ZDI right? They're sort of paid to keep this secret. As for gathering existing SHA1 hashes, I'll look into that. Could be a way to seed the database ahead of time. And no, I'm not a cleverness junkie. I mean, it's a shell script that's like 8 lines long. I just saw a problem in getting a vendor's "public key" and then realized I could do it this way.