Looking forward to trying to explain to non-technical security people and managers that although they've fixed CVE-2023-1234 they now need to fix NotCVE-2023-12

Looking forward to trying to explain to non-technical security people and managers that although they've fixed CVE-2023-1234 they now need to fix NotCVE-2023-1234 which is a completely different and unrelated thing. And even more so if a vuln later gets accepted as a CVE, so that NotCVE-2023-1234 is the same issue as CVE-2023-2345. It's a damn sight better than their original plan of having it be !CVE-2023-1234, but still seems like that naming pattern is just going to cause confusion. The site also seems to be missing an kind of details that would make it more useful. For instance, if you look at NotCVE-2023-0002 (https://notcve.org/view.php?id=NotCVE-2023-0002 https://notcve.org/view.php?id=NotCVE-2023-0002), it's apparently a buffer overflow in NVD Tools. But there's no real references, no indication about why it's not a CVE, if there was an attempt at disclosure, if the vendor has justified why it's not an issue, etc.