7 ms·
I'm trying to steelman but I really can't think of a non- nefarious justification for this
by Rebelgecko 2y ago
I'm trying to steelman but I really can't think of a non- nefarious justification for this
- sneak 2y ago[flagged]
- viraptor 2y agoYet so far no volunteer has emerged and people who do run CNA are pretty busy with it.
- _zer0 2y agoI think sneak would volunteer to do it since it is pretty simple according to them.
- mlinhares 2y agoAny work people don't understand must be easy and replaceable by chatgpt. Just look at how easy people here think farming is.
- johnnyjeans 2y agoGrok becoming an artificial nepobaby running the entire CVE program with zero oversight sounds so fucking funny I don't even care, PLEASE god make this real holy shit I can't breathe at the thought
- stevekemp 2y agoThere were some, short-lived, projects/groups trying to run their own processes. DWF is one that I recall, though it is dead again: https://lwn.net/Articles/851849/ https://lwn.net/Articles/851849/
- Rebelgecko 2y agoHow do you get your volunteers in the first place and manage them so you know it's time to get a new one if the quality of their work is slipping?
- skeledrew 2y agoWho needs volunteers? Let AI handle it!
- fnordpiglet 2y agoThis is like saying the patent system is just an incrementing counter.
- sneak 2y agoHave you seen the patents they have been giving out lately?
- gessha 2y agoFound the blackhat
- _carbyau_ 2y agoThanks for volunteering to manage the "300-600 CVEs each month"! The world needs more volunteers like you.
- charcircuit 2y agoYou manage the system and not the CVEs themselves. The simplist thing would be a list of numbers that correspond to Google docs. The owner of the Google doc can share it with the needed parties and eventually set it as public.
- goku12 2y agoYou truly believe that the CVE database (and others like CWE) are only about assigning serial numbers to random reports, don't you? I see people underestimating and understanding the work of others in matters like this. Is that a trend now?
- charcircuit 2y agoNo I don't believe that, but it might as well operate like that. The extra stuff isn't truly needed and was being outsourced to the companies that own the products since it wasn't providing much value. Take a look at Daniel's blog posts about CVEs for curl for what happens when you let them handle it.
- worthless-trash 2y agoI saw this same behavior quite a while back. While I'm out of the CVE game these days, it seems that there is a forever rotating new group of people who simply don't and can never see the complexities on the process. I think it's a testament to the previous stewardship that it appears so simple.
- techky 2y agoMake that 3,000-4,000 on average per month, according to NISTs stats on CVEs for last year. ~40,000 for 2024.
- 2y ago
- duxup 2y agoThe process seems to be to dismantle anything not nailed down in government. Now if you want that (even just funding) to be a thing ... you have to go through Trump & Co and pay your bribe to get it back up.
- esafak 2y agoPrivatize all teh things?
- benfortuna 2y agoThis neo-liberal approach has no place for soft diplomacy, which is what US hegemoney relies on. This isn't just a rapid disassembly of economic structures, any trust and goodwill is completely obliterated as well.
- tart-lemonade 2y agoFor decades, the US could be counted upon to fund things with little immediate benefit but massive long-term positive externalities. I don't think its likely that the republican party will "go back to normal" post-Trump, so we can all kiss the long-term reputation building that American hegemony relied upon goodbye. Short of a great depression-esque political reset, I do not see things changing for the better.
- transpute 2y agoApril 2024 article on the result of NVD funding cutbacks, with comments by Linux Foundation OpenSSF, security startups like ChainGuard and commercial vendors, https://www.securityweek.com/cve-and-nvd-a-weak-and-fractured-source-of-vulnerability-truth/ https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture... Threat intelligence firm Flashpoint noted in March 2024 it was aware of 100,000 vulnerabilities with no CVE number and consequently no inclusion in NVD. More worryingly, it said that 330 of these vulnerabilities (with no CVE number) had been exploited in the wild.. Since the start of 2024 there have been a total of 6,171 total CVE IDs with only 3,625 being enriched by NVD. That leaves a gap of 2,546 (42%!) IDs. Despite all those private companies and various OSS projects being willing to contribute ideas, infrastructure and code, they have somehow failed to coalesce into a decentralized replacement for NVD, built on CC0 data and OSS tooling.
- cma 2y agoI tried to look over the history and I only see a funding increase, CISA cut $3.7 million at the end of 2023 for the next year and in response NIST reallocated extra funding to NVD: $8.5 million in 2024 A funding shortfall and strain isn't a funding cut. And from what I see there was a funding increase.
- giraffe_lady 2y ago> I'm trying to steelman Why? This administration is not acting in good faith, you don't have to act as if they are. People and institutions doing that is part of how we got here in the first place.
- jfengel 2y agoForce of habit. We don't have a framework for talking under these circumstances, so we apply our outdated ones. As you say, that's exactly what got us here. But the alternatives are very unclear, and seem deeply unpleasant.
- giraffe_lady 2y ago[flagged]
- MiguelX413 2y agoPeople should suck it up and not do it again.
- jfengel 2y agoThe question is what they should do instead. They could attack the non-steelmanned version, but that just opens them up to having their own comments attacked. You quickly get derailed. (It's sometimes called "sealioning".) They could propose alternatives, but that too is subject to sealioning. Real alternatives are always subject to tradeoffs, and the answer to "how about you do X instead of attacking me?" is always "no". They could refrain from discussing it, but that just allows the offenses to continue. So what often happens is that people persist in acting as if this were a sincere discussion, and hope that a majority will recognize the quality of your argument. It's a lousy plan but I don't have much else to suggest.
- King-Aaron 2y agoI still find it wild that so many people are trying to frame these decisions through a political lens. This is the actions of a foreign bad actor dismantling critical institutions from within, not "bad policy". Surely there's an antibody response.
- rqtwteye 2y agoI think it’s ignorance and arrogance. The US seems to be on a path to lose technological and science leadership. The current leadership doesn’t seem to understand things that aren’t flashy. I wonder when they’ll dial back on food safety. I am sure RFK knows some vitamins that protect against salmonella
- johnnyjeans 2y agoimportant to note: the US's food safety is already really bad. salmonella isn't a thing you have to worry about in first world countries. can't wait to see what plague demon spawns out of a food industry running amok after the FDA gets gutted.
- ac29 2y ago> important to note: the US's food safety is already really bad. salmonella isn't a thing you have to worry about in first world countries. There were 65,000 cases of salmonellosis in the EU in the most recent data I could find (2022). Thats a lower per capita rate than the US, but definitely not zero.
- rickard 2y agoI agree that it’s not zero, but according to CDC, the US sees about 1.35 million cases per year in a population of about 346 million, which is about 390 cases per 100,000 people. Your figure for the EU over a population of 447 million in 2022 gives 14.5 cases per 100,000 people, or more than a factor of 26 less. Being 26 times less worried about something translates, at least for most things, for me, to not being worried about it any more.
- WrongAssumption 2y agoThat’s just not true. https://www.npr.org/sections/shots-health-news/2025/04/15/nx-s1-5364940/chlorinated-chicken-trump-tariffs-uk-eu#:~:text=Europe%20tends%20to%20operate%20on,effective%20at%20eliminating%20the%20risk. https://www.npr.org/sections/shots-health-news/2025/04/15/nx...
- 2y ago
- polski-g 2y agoWe have a 2tn deficit. If Congress wants to fund this, they need to make it mandatory spending and raise taxes.
- toomuchtodo 2y agoOr cut from $877B in defense spending instead? https://usafacts.org/government-spending/ https://usafacts.org/government-spending/
- xphos 2y agoListen, I hate the debt, but we have an income problem, not a spending problem. The military looks like a waste, but it does more than build bombs i.e research etc. The issue we have is that republican every chance they get since the 1970s have cut taxes. And then blamed democrats for causing the deficits. We don't need smaller governments. We need a reasonable tax system that taxes people. It can be progressive like it was before we decided rich people just need it easier than poor people. Yes, I will pay more taxes sign me up, especially if they can finally fix the roads and fund research. The problem is my taxes as a middle-class person go up and rich people get a tax cut. It's stupid. I like water provided by government utilities, I like planes that don't crash into stuff because there are air traffic controllers. These things used to work because we paid for them. When you buy cheap you get cheap.
- dboreham 2y agoMilitary also employs a bunch of people who otherwise would be poor. Also provides a gentrification path for a bunch of previously poor people extending throughout their lives.
- LPisGood 2y agoYes, a big part of the size is because the military is a massive and horrendously inefficient jobs, education, housing, and healthcare program.
- alephnerd 2y ago> I really can't think of a non- nefarious justification for this Tragedy of the commons - NVD and the CVE project havr been backlogged and facing funding issues for a couple years now, and most security vendors are either cagey about providing vulns in a timely manner (as it can reduce their own comparative advantage), or try upsell their own alternative risk prioritization scores. Every company will gladly use NVD and CVE data, but no one wants to subsidize it and help a competitor, especially in an industry as competitive as cybersecurity.
- WesternWind 2y agoIt's incredibly foolish. Whatever the justification is, it doesn't matter as much as the horrible outcome. This is one of those things the government does for the benefit of the whole.
- ajross 2y agoProbably the thinking goes that someone in the international community will step in. CVE is in practice a global registry for all, thus "Why should the USA Department of Homeland Security pay for all the freeloaders". Still shortsighted and stupid, but it's plausible this is intended as leverage to get someone else to pony up.
- Cthulhu_ 2y agoReduce government spending; since it's not actually a government organization (as far as I can tell, I never looked into it before), other organizations can fund it. How much goes into this organization a year anyway? I'm seeing a Mitre corporation that does lots of other stuff too that has a revenue of 2.2 billion a year. Multi-trillion-dollar companies benefit from and contribute to this system, surely they can spare 0.01% of their revenue to this bit of critical infrastruture?
- bert-ye 2y ago> surely they can spare 0.01% of their revenue They would, if we made companies pay their taxes. Yes, you can also run such a system based on donations. But I personally think that such a system is important enough to be paid for by the government. When you run on donations, there will always be conflicts of interest and the risk of running out of funds. But yeah, Mitre being a private organization that was paid for by the government was a problem.
- terribleperson 2y agoYes, I'm sure corporations funding the CVE system would go wonderfully. "It would be best if we don't see any severe CVEs for our products this quarter, if you want our funding next quarter."
- kesor 2y agoMITRE is a non-profit, it receives about $1.5B from the federal government, and another almost $2B from Virginia.
- karel-3d 2y agoReduce spending. Steelmanning (not actually believing this): it probably cost a lot for what is essentially a database, and can be done cheaply by private sector (Google, Microsoft).
- myko 2y agoIt's a dying empire, really nothing else to say. The USA led world order is over, we've voted ourselves out of it, and now need to learn how to deal with that.
- drstewart 2y agoWow! So who is leading the world order now (aka who is funding MITRE)?
- throw4847285 2y agoI'll admit this is a bugbear of mine, but I think this is the reason "steelmanning" is counterproductive. Steelmanning is a neologism that serves no purpose other than in-group signaling. There was already a perfectly acceptable term for the same concept, one with more nuance and a rich history: Charitability. The major difference is that charitability is about treating your interlocutor with respect. Steelmanning is about using one's own intellect to make your interlocutor's argument better than them. Because charitability is based on a concept of mutual respect, if somebody clearly doesn't respect you one iota, then why would you be charitable? Steelmanning tries to divorce the person from the argument, and is ironically both arrogant and naive.